bzip2 TOCTOU symlink
| bzip2-toctou-symlink (19926) |  Medium Risk |
Description:
bzip2 could allow a local attacker to launch a symlink attack. If the local attacker has write access to the directory of a user using bzip2, the local attacker could exploit a TOCTOU vulnerability using a symlink to change file permissions of arbitrary files.
Platforms Affected:
- Apple, Mac OS X 10.4
- Apple, Mac OS X 10.4.1
- Apple, Mac OS X 10.4.10
- Apple, Mac OS X 10.4.2
- Apple, Mac OS X 10.4.3
- Apple, Mac OS X 10.4.4
- Apple, Mac OS X 10.4.5
- Apple, Mac OS X 10.4.6
- Apple, Mac OS X 10.4.7
- Apple, Mac OS X 10.4.8
- Apple, Mac OS X 10.4.9
- Apple, Mac OS X Server 10.4
- Apple, Mac OS X Server 10.4.1
- Apple, Mac OS X Server 10.4.10
- Apple, Mac OS X Server 10.4.2
- Apple, Mac OS X Server 10.4.3
- Apple, Mac OS X Server 10.4.4
- Apple, Mac OS X Server 10.4.5
- Apple, Mac OS X Server 10.4.6
- Apple, Mac OS X Server 10.4.7
- Apple, Mac OS X Server 10.4.8
- Apple, Mac OS X Server 10.4.9
- Canonical, Ubuntu 4.10
- Canonical, Ubuntu 5.04
- Conectiva, Linux 10
- Conectiva, Linux 9.0
- Debian, Debian Linux 3.0
- Julian Seward, bzip2 1.0.2 and prior
- MandrakeSoft, Mandrake Linux 10.0
- MandrakeSoft, Mandrake Linux 10.0 AMD64
- MandrakeSoft, Mandrake Linux 10.1 X86_64
- MandrakeSoft, Mandrake Linux 10.1
- MandrakeSoft, Mandrake Linux 2006 X86_64
- MandrakeSoft, Mandrake Linux 2006
- MandrakeSoft, Mandrake Linux LE2005
- MandrakeSoft, Mandrake Linux LE2005 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 2.1 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 2.1
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Multi Network Firewall 2.0
- OpenPKG, OpenPKG 2-STABLE
- OpenPKG, OpenPKG 2.1
- OpenPKG, OpenPKG 2.2
- OpenPKG, OpenPKG 2.3
- OpenPKG, OpenPKG CURRENT
- OpenPKG, OpenPKG Enterprise E1.0-SOLID
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Linux Advanced Workstation 2.1 Itanium
- Sun, Solaris 10 SPARC
- Sun, Solaris 10 x86
- Sun, Solaris 8.0 x86
- Sun, Solaris 8.0 SPARC
- Sun, Solaris 9.0 x86
- Sun, Solaris 9.0 SPARC
- Turbolinux, Turbolinux 10 Desktop
- Turbolinux, Turbolinux 10 F...
- Turbolinux, Turbolinux 10 Server
- Turbolinux, Turbolinux 7 Server
- Turbolinux, Turbolinux 7 Workstation
- Turbolinux, Turbolinux 8 Server
- Turbolinux, Turbolinux 8 Workstation
- Turbolinux, Turbolinux Home
- Turbolinux, Turbolinux Appliance Server 1.0 Hosting Ed
- Turbolinux, Turbolinux Appliance Server 1.0 Workgroup Ed
Remedy:
Upgrade to the latest version of bzip2 (1.0.3 or later), available from the bzip2 Web page. See References.
For other distributions:
Apply the appropriate update for your system. See References..
Consequences:
File Manipulation
References:
- Apple Web site, About the security content of Mac OS X 10.4.11 and Security Update 2007-008 at http://docs.info.apple.com/article.html?artnum=307041.
- BugTraq Mailing List, Wed Mar 30 2005 - 15:38:55 CST , bzip2 TOCTOU file-permissions vulnerability at http://archives.neohapsis.com/archives/bugtraq/2005-03/0523.html.
- bzip2 Web site, The bzip2 and libbzip2 official home page at http://sources.redhat.com/bzip2/index.html.
- Conectiva Linux Security Announcement CLSA-2005:972, bzip2 security fixes at http://distro.conectiva.com/atualizacoes/index.php?id=a&anuncio=000972.
- FreeBSD Security Advisory FreeBSD-SA-05:14.bzip2, bzip2 denial of service and permission race vulnerabilities at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:14.bzip2.asc.
- Sun Alert ID: 103118, Two Security Vulnerabilities in the bzip2(1) Command may Allow the Permissions of Arbitrary Files to be Modified or Allow for Arbitrarily Large Files to be Created at http://sunsolve.sun.com/search/document.do?assetkey=1-26-103118-1.
- ASA-2007-451: Two Security Vulnerabilities in the bzip2(1) Command may Allow the Permissions of Arbitrary Files to be Modified or Allow for Arbitrarily Large Files to be Created (Sun 103118)
- BID-12954: bzip2 chmod File Permission Modification Race Condition Weakness
- BID-26444: Apple Mac OS X v10.4.11 2007-008 Multiple Security Vulnerabilities
- CVE-2005-0953: Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete.
- DSA-730: bzip2 -- race condition
- FrSIRT/ADV-2007-3525: Sun Solaris Security Update Fixes bzip2 Security Bypass and DoS Issues
- FrSIRT/ADV-2007-3868: Apple Mac OS X Command Execution and Denial of Service Vulnerabilities
- MDKSA-2005:091: Updated bzip2 packages fix multiple vulnerabilities
- MDKSA-2006:026: Updated bzip2 packages fix bzgrep vulnerabilities
- OpenPKG-SA-2005.008: bzip2
- OpenPKG-SA-2005.010: OpenPKG
- OpenPKG-SA-2007.002: bzip2
- RHSA-2005-474: bzip2 security update
- SA27274: Sun Solaris bzip2 Multiple Vulnerabilities
- SA27643: Apple Mac OS X Security Update Fixes Multiple Vulnerabilities
Reported:
Mar 30, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net