PT-2014-2157 · Bzip2 · Bzip2

Vladz · Published 2014-04-16 · Updated 2014-04-17 · CVE-2011-4089

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions bzip2 versions 1.0.5 and earlier

Description The issue arises from the bzexe command in bzip2, which generates compressed executables that do not properly handle temporary files during extraction. This allows local users to execute arbitrary code by precreating a temporary directory.

Recommendations For bzip2 versions 1.0.5 and earlier, consider updating to a version later than 1.0.5 to resolve the issue. As a temporary workaround, restrict access to the bzexe command to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-4089

Affected Products

Bzip2

References · 10

• 🔥 https://exploit-db.com/exploits/18147 · Exploit
• 🔥 http://exploit-db.com/exploits/18147 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-4089 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-4089 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-4089 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-4089 · Security Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=632862 · Patch
• http://openwall.com/lists/oss-security/2011/10/28/16 · Note
• http://seclists.org/fulldisclosure/2011/Oct/804 · Note
• http://ubuntu.com/usn/USN-1308-1 · Patch, Vendor Advisory