Updated gzip packages are avaialble for Red Hat Linux 7.3/9 and Fedora Core 1/2
---------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated gzip package fixes security issues
Advisory ID: FLSA:157696
Issue date: 2005-08-10
Product: Red Hat Linux, Fedora Core
Keywords: Bugfix
CVE Names: CAN-2005-0758 CAN-2005-0988 CAN-2005-1228
---------------------------------------------------------------------
---------------------------------------------------------------------
1. Topic:
An updated gzip package is now available.
The gzip package contains the GNU gzip data compression program.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386
Fedora Core 2 - i386
3. Problem description:
A bug was found in the way zgrep processes file names. If a user can be tricked into running zgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running zgrep. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0758 to this issue.
A bug was found in the way gunzip modifies permissions of files being decompressed. A local attacker with write permissions in the directory in which a victim is decompressing a file could remove the file being written and replace it with a hard link to a different file owned by the victim, gunzip then gives the linked file the permissions of the uncompressed file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0988 to this issue.
A directory traversal bug was found in the way gunzip processes the -N flag. If a victim decompresses a file with the -N flag, gunzip fails to sanitize the path which could result in a file owned by the victim being overwritten. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1228 to this issue.
Users of gzip should upgrade to this updated package, which contains backported patches to correct these issues.
4. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs.
Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get.
5. Bug IDs fixed:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=157696
6. RPMs required:
Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/gzip-1.3.3-1.2.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/gzip-1.3.3-1.2.legacy.i386.rpm
Red Hat Linux 9:
SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gzip-1.3.3-9.2.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/gzip-1.3.3-9.2.legacy.i386.rpm
Fedora Core 1:
SRPM:
http://download.fedoralegacy.org/fedora/1/updates/SRPMS/gzip-1.3.3-11.2.legacy.src.rpm
i386:
http://download.fedoralegacy.org/fedora/1/updates/i386/gzip-1.3.3-11.2.legacy.i386.rpm
Fedora Core 2:
SRPM:
http://download.fedoralegacy.org/fedora/2/updates/SRPMS/gzip-1.3.3-12.2.legacy.src.rpm
i386:
http://download.fedoralegacy.org/fedora/2/updates/i386/gzip-1.3.3-12.2.legacy.i386.rpm
7. Verification:
SHA1 sum Package Name
---------------------------------------------------------------------
16a19e2142d83f1db86dbf5a9a5a0b4e35d50c92
redhat/7.3/updates/i386/gzip-1.3.3-1.2.legacy.i386.rpm
98e5fcc727442dd531277cffc2771b7bc8d5f1f8
redhat/7.3/updates/SRPMS/gzip-1.3.3-1.2.legacy.src.rpm
7960019da89fbdee222e71b7d9884e6dc9ed3056
redhat/9/updates/i386/gzip-1.3.3-9.2.legacy.i386.rpm
de3e4e8dd934c383feb2a464b522c4e62bdd3f6d
redhat/9/updates/SRPMS/gzip-1.3.3-9.2.legacy.src.rpm
b5cc020182af4b945a461c35e1adc3ddb15e953b
fedora/1/updates/i386/gzip-1.3.3-11.2.legacy.i386.rpm
28c8700ac53cb6f8110c744ffc8456095cf9d051
fedora/1/updates/SRPMS/gzip-1.3.3-11.2.legacy.src.rpm
3d056ec2af5e344ef56e22049e5bd196f0c27180
fedora/2/updates/i386/gzip-1.3.3-12.2.legacy.i386.rpm
f6b4d52075528761fd56e44c8227c45130f959b0
fedora/2/updates/SRPMS/gzip-1.3.3-12.2.legacy.src.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0758
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0988
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1228
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More project details at http://www.fedoralegacy.org
---------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated gzip package fixes security issues
Advisory ID: FLSA:157696
Issue date: 2005-08-10
Product: Red Hat Linux, Fedora Core
Keywords: Bugfix
CVE Names: CAN-2005-0758 CAN-2005-0988 CAN-2005-1228
---------------------------------------------------------------------
---------------------------------------------------------------------
1. Topic:
An updated gzip package is now available.
The gzip package contains the GNU gzip data compression program.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386
Fedora Core 2 - i386
3. Problem description:
A bug was found in the way zgrep processes file names. If a user can be tricked into running zgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running zgrep. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0758 to this issue.
A bug was found in the way gunzip modifies permissions of files being decompressed. A local attacker with write permissions in the directory in which a victim is decompressing a file could remove the file being written and replace it with a hard link to a different file owned by the victim, gunzip then gives the linked file the permissions of the uncompressed file. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0988 to this issue.
A directory traversal bug was found in the way gunzip processes the -N flag. If a victim decompresses a file with the -N flag, gunzip fails to sanitize the path which could result in a file owned by the victim being overwritten. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-1228 to this issue.
Users of gzip should upgrade to this updated package, which contains backported patches to correct these issues.
4. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs.
Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get.
5. Bug IDs fixed:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=157696
6. RPMs required:
Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/gzip-1.3.3-1.2.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/gzip-1.3.3-1.2.legacy.i386.rpm
Red Hat Linux 9:
SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gzip-1.3.3-9.2.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/gzip-1.3.3-9.2.legacy.i386.rpm
Fedora Core 1:
SRPM:
http://download.fedoralegacy.org/fedora/1/updates/SRPMS/gzip-1.3.3-11.2.legacy.src.rpm
i386:
http://download.fedoralegacy.org/fedora/1/updates/i386/gzip-1.3.3-11.2.legacy.i386.rpm
Fedora Core 2:
SRPM:
http://download.fedoralegacy.org/fedora/2/updates/SRPMS/gzip-1.3.3-12.2.legacy.src.rpm
i386:
http://download.fedoralegacy.org/fedora/2/updates/i386/gzip-1.3.3-12.2.legacy.i386.rpm
7. Verification:
SHA1 sum Package Name
---------------------------------------------------------------------
16a19e2142d83f1db86dbf5a9a5a0b4e35d50c92
redhat/7.3/updates/i386/gzip-1.3.3-1.2.legacy.i386.rpm
98e5fcc727442dd531277cffc2771b7bc8d5f1f8
redhat/7.3/updates/SRPMS/gzip-1.3.3-1.2.legacy.src.rpm
7960019da89fbdee222e71b7d9884e6dc9ed3056
redhat/9/updates/i386/gzip-1.3.3-9.2.legacy.i386.rpm
de3e4e8dd934c383feb2a464b522c4e62bdd3f6d
redhat/9/updates/SRPMS/gzip-1.3.3-9.2.legacy.src.rpm
b5cc020182af4b945a461c35e1adc3ddb15e953b
fedora/1/updates/i386/gzip-1.3.3-11.2.legacy.i386.rpm
28c8700ac53cb6f8110c744ffc8456095cf9d051
fedora/1/updates/SRPMS/gzip-1.3.3-11.2.legacy.src.rpm
3d056ec2af5e344ef56e22049e5bd196f0c27180
fedora/2/updates/i386/gzip-1.3.3-12.2.legacy.i386.rpm
f6b4d52075528761fd56e44c8227c45130f959b0
fedora/2/updates/SRPMS/gzip-1.3.3-12.2.legacy.src.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0758
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0988
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1228
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More project details at http://www.fedoralegacy.org
