PT-2002-1781 · Bzip2+2 · Bzip2+2

Publicado 2002-08-12 · Atualizado 2008-09-05 · CVE-2002-0760

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Baixa

Vetor base

AV:L/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions bzip2 versions prior to 1.0.2 FreeBSD versions 4.5 and earlier OpenLinux versions 3.1 and 3.1.1

Description A race condition exists in bzip2, which could allow local users to read files as they are being decompressed. The issue arises because bzip2 decompresses files with world-readable permissions before setting the permissions to what is specified in the bzip2 archive.

Recommendations For bzip2 versions prior to 1.0.2, update to version 1.0.2 or later to resolve the issue. For FreeBSD versions 4.5 and earlier, consider upgrading to a newer version of FreeBSD that includes the fixed bzip2 version. For OpenLinux versions 3.1 and 3.1.1, consider upgrading to a newer version of OpenLinux that includes the fixed bzip2 version.

Correção

Identificadores relacionados

CVE-2002-0760

Produtos afetados

Freebsd

Openlinux

Bzip2

Referências · 5

• http://securityfocus.com/bid/4775 · Aviso do Fabricante
• ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-039.0.txt · Aviso do Fabricante
• http://iss.net/security_center/static/9127.php · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0760 · Nota de Segurança
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:25.bzip2.asc · Aviso do Fabricante