Debian update for gzip - Secunia Advisories - Vulnerability Intelligence

Debian update for gzip
Secunia Advisory:	SA8990	Advisory Toolbox: Issue ticket Save in to-do list Mark as handled Exploit information Download as PDF Review actions Add comment
Release Date:	2003-06-11
Popularity:	7,517 views

Critical:	Less critical
Impact:	Privilege escalation
Where:	Local system
Solution Status:	Vendor Patch

OS:	Debian GNU/Linux 2.x Debian GNU/Linux 3.0

Subscribe:	Instant alerts on relevant vulnerabilities

CVE reference:	CVE-1999-1332 CVE-2003-0367

Description: A vulnerability has been identified in znew allowing malicious, local users escalate privileges. The problem is a race condition in the way that znew and gzexe handles temporary files. This allows malicious, local users to launch a symlink attack, which could lead to overwriting arbitrary files that the user executing znew or gzexe got write access too. The vulnerability in gzexe has been fixed earlier but has resurfaced later. Solution: Updated packages: Debian GNU/Linux 3.0 alias woody Source archives: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1.dsc Size/MD5 checksum: 577 affc0d3b073378cd2dc13c2a6772810a http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1.diff.gz Size/MD5 checksum: 5554 abd3dee3183d8c20f58c792206cec6e5 http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2.orig.tar.gz Size/MD5 checksum: 311011 57bff96b6b4bcbb060566bdbed29485d Alpha architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_alpha.deb Size/MD5 checksum: 76240 8b1022a3708b29162831ae85307cb4de ARM architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_arm.deb Size/MD5 checksum: 68538 8f640e909866da6602c2854375fa3b70 Intel IA-32 architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_i386.deb Size/MD5 checksum: 61868 a224c831e1a801e980801b63fde5a031 Intel IA-64 architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_ia64.deb Size/MD5 checksum: 86622 67e08c2b9b1011544b8303376f920df7 HP Precision architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_hppa.deb Size/MD5 checksum: 72366 334d7a9b874026c95ea4a3b37b693691 Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_m68k.deb Size/MD5 checksum: 61134 0e8cc087cfb00ec478c48c6f0b177ea1 Big endian MIPS architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_mips.deb Size/MD5 checksum: 71524 acc8077c42714b77a73e55ae77a6493f Little endian MIPS architecture: http://security.debian.org/pool/updat.../g/gzip/gzip_1.3.2-3woody1_mipsel.deb Size/MD5 checksum: 71388 c81151864b2453826712ac969e73535c PowerPC architecture: http://security.debian.org/pool/updat...g/gzip/gzip_1.3.2-3woody1_powerpc.deb Size/MD5 checksum: 69062 91de386eef5133dbd777934a3ff6668f IBM S/390 architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_s390.deb Size/MD5 checksum: 66508 391497f880223b95fbf2b6b3d72160eb Sun Sparc architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_sparc.deb Size/MD5 checksum: 70058 3c9c0854327fec243b228108ec29f4b8 Debian GNU/Linux 2.2 alias potato Source archives: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2.dsc Size/MD5 checksum: 542 0c5d9c072d3b99c09cf139799b1c1031 http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2.diff.gz Size/MD5 checksum: 10142 0cec25832d0eaff865a27489f0757d8b http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4.orig.tar.gz Size/MD5 checksum: 220976 b94b3e07797e0cbf3622bb2fe5682f0b Alpha architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_alpha.deb Size/MD5 checksum: 78936 a17b1e7130835c9f08bec9b0ff715bb1 ARM architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_arm.deb Size/MD5 checksum: 68906 9f0730655e6b5011a0b69800cc032e89 Intel IA-32 architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_i386.deb Size/MD5 checksum: 62820 77377a288598140ab73d58952c8f2ea4 Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_m68k.deb Size/MD5 checksum: 62110 27c2275eb1b2331b6b2444fec1e0cc7b PowerPC architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_powerpc.deb Size/MD5 checksum: 69882 5b91a3a96fb4bc6efb0d98402f55c4a6 Sun Sparc architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_sparc.deb Size/MD5 checksum: 71404 4e404ee1024af95725b99abe05bbecf5 Provided and/or discovered by: Paul Szabo

Track this Secunia Advisory
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released. Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.

About this Secunia Advisory
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise. Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.

Latest Advisories

2nd Dec, 2008

New advisories:	14
New vulnerabilities:	21
Updated advisories:	26

Less // 375 views

Linksys WRT160N Cross-Site Scripting Vulnerability

Less // 356 views

IBM Rational ClearQuest Multiple Vulnerabilities

Not // 281 views

Debian update for flamethrower

Not // 273 views

flamethrower Insecure Temporary Files

Less // 328 views

IBM Rational ClearCase Cross-Site Scripting Vulnerability

Not // 315 views

DAHDI "ZT_SPANCONFIG" IOCTL Privilege Escalation Vulnerability

Not // 313 views

Zaptel "ZT_SPANCONFIG" IOCTL Privilege Escalation Vulnerabilities

Moderately // 299 views

Rumpus Multiple Vulnerabilities

Less // 318 views

bcoos "cid" SQL Injection Vulnerability

Moderately // 332 views

ASP Portal "ASPPortal.mdb" Database Disclosure Security Issue

Solutions | More...

Send Feedback to Secunia
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com. Ideas, suggestions, and other feedback are most welcome.