PT-2002-1780 · Bzip2 · Bzip2

Published 2002-08-12 · Updated 2008-09-05 · CVE-2002-0759

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions bzip2 versions prior to 1.0.2

Description The issue allows attackers to overwrite files via a bzip2 archive because bzip2 does not use the O EXCL flag to create files during decompression and does not warn the user if an existing file would be overwritten.

Recommendations For versions prior to 1.0.2, update to version 1.0.2 or later to resolve the issue.

Fix

Related Identifiers

CVE-2002-0759

Affected Products

Bzip2

References · 5

• ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-039.0.txt · Vendor Advisory
• http://iss.net/security_center/static/9126.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0759 · Security Note
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:25.bzip2.asc · Vendor Advisory
• http://securityfocus.com/bid/4774 · Vendor Advisory