================================ gzip directory traversal vulnerability ================================ Software: gzip Version: 1.2.4, 1.3.3 Software URL: <http://www.gzip.org> Platform: Unix, Linux. Vulnerability type: Input validation Severity: Medium, local vuln, requires user using gunzip -N on a malicious zip file. Can result in privilege escalation. Vulnerable software ==================== gzip 1.2.4 and 1.3.3 and previous versions running on unix. Vulnerability ============== Ulf Härnhammar <metaur@xxxxxxxxx> has discovered a vulnerability in gunzip that allows a malicious zip file to extract to an arbitrary directory of the attackers choice when gunzip is used with the -N option. Further details of this vulnerability are available in the Debian bug report #305255. Direct link: <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=305255> This vulnerability can be used to make the gzip file extract to a directory which the attacker has write access to. This vulnerability then be used in combination with the gzip TOCTOU file-permissions vulnerability (CAN-2005-0988, Bugtraq #12996) to change the permissions on arbitrary files belonging to the user. Fix ==== A patch developed by Ulf Härnhammar is linked to from the bug report link given above.
