PT-2002-1781 · Bzip2+2 · Bzip2+2

Published 2002-08-12 · Updated 2008-09-05 · CVE-2002-0760

Positive Technologies (AI Summary)

CVSS v2.0

1.2

Low

Base vector

AV:L/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions bzip2 versions prior to 1.0.2 FreeBSD versions 4.5 and earlier OpenLinux versions 3.1 and 3.1.1

Description A race condition exists in bzip2, which could allow local users to read files as they are being decompressed. The issue arises because bzip2 decompresses files with world-readable permissions before setting the permissions to what is specified in the bzip2 archive.

Recommendations For bzip2 versions prior to 1.0.2, update to version 1.0.2 or later to resolve the issue. For FreeBSD versions 4.5 and earlier, consider upgrading to a newer version of FreeBSD that includes the fixed bzip2 version. For OpenLinux versions 3.1 and 3.1.1, consider upgrading to a newer version of OpenLinux that includes the fixed bzip2 version.

Fix

Related Identifiers

CVE-2002-0760

Affected Products

Freebsd

Openlinux

Bzip2

References · 5

• http://securityfocus.com/bid/4775 · Vendor Advisory
• ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-039.0.txt · Vendor Advisory
• http://iss.net/security_center/static/9127.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0760 · Security Note
• ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:25.bzip2.asc · Vendor Advisory