PT-2014-2157 · Bzip2 · Bzip2

Vladz · Publicado 2014-04-16 · Atualizado 2014-04-17 · CVE-2011-4089

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Média

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions bzip2 versions 1.0.5 and earlier

Description The issue arises from the bzexe command in bzip2, which generates compressed executables that do not properly handle temporary files during extraction. This allows local users to execute arbitrary code by precreating a temporary directory.

Recommendations For bzip2 versions 1.0.5 and earlier, consider updating to a version later than 1.0.5 to resolve the issue. As a temporary workaround, restrict access to the bzexe command to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-4089

Produtos afetados

Bzip2

Referências · 10

• 🔥 https://exploit-db.com/exploits/18147 · Exploit
• 🔥 http://exploit-db.com/exploits/18147 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4089 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/10/28/16 · Nota
• https://osv.dev/vulnerability/CVE-2011-4089 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2011/Oct/804 · Nota
• http://ubuntu.com/usn/USN-1308-1 · Correção, Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2011-4089 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-4089 · Nota de Segurança
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632862 · Correção