OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2003.031
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2003.031
Advisory Published:      2008-11-21 22:34 UTC

Issue Id (internal):     OpenPKG-SI-20030611.01
Issue First Created:     2003-06-11
Issue Last Modified:     2006-11-28
Issue Revision:          05


Subject Name:            gzip
Subject Summary:         De-/Compression with GZIP Algorithm
Subject Home:            http://www.gzip.org/
Subject Versions:        * <= 1.3.5

Vulnerability Id:        CVE-2003-0367
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           local system
Attack Impact:           privilege escalation

Description:
    According to a Debian security advisory [0], based on hints from Paul
    Szabo, a vulnerability exists in the creation of temporary files in
    the znew(1) utility contained in GNU Zip (gzip) [1]. The GNU Bash
    based znew(1) shell script tried to prevent itself from overwriting
    existing files on shell redirection by using the POSIX "noclobber"
    shell option, but accidentally forgot to check for the results, and
    in case of existing files, stop further processing. This allowed a
    classical "symlink" attack.

References:
    [0] http://www.debian.org/security/2003/dsa-308
    [1] http://www.gzip.org/
    [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0367
    [3] http://www.openpkg.org/tutorial.html#regular-source
    [4] http://www.openpkg.org/tutorial.html#regular-binary
    [5] ftp://ftp.openpkg.org/release/1.1/UPD/gzip-1.3.3-1.1.1.src.rpm
    [6] ftp://ftp.openpkg.org/release/1.2/UPD/gzip-1.3.5-1.2.1.src.rpm
    [7] ftp://ftp.openpkg.org/release/1.1/UPD/
    [8] ftp://ftp.openpkg.org/release/1.2/UPD/
    [9] http://www.openpkg.org/security.html#signature


Primary Package Name:    gzip
Primary Package Home:    http://openpkg.org/go/package/gzip

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        1.1-SOLID         gzip-1.3.3-1.1.0
OpenPKG Community        1.2-SOLID         gzip-1.3.5-1.2.0
OpenPKG Community        CURRENT           gzip-1.3.5-20030409

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        1.1-SOLID         gzip-1.3.3-1.1.1
OpenPKG Community        1.2-SOLID         gzip-1.3.5-1.2.1
OpenPKG Community        CURRENT           gzip-1.3.5-20030610