bzip2 1.0.2 Security Issue

win32sux · 05-27-2005, 01:40 PM

Quote:

Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete.

http://www.cve.mitre.org/cgi-bin/cve...=CAN-2005-0953

the bzip2 website states that:

Quote:

The current version is 1.0.3, released 15 February 2005.

i'm on an up-to-date slackware 10.1 and it currently has bzip2 1.0.2:

Code:

bash-3.00$ ls /var/log/packages/ | grep bzip2
bzip2-1.0.2-i486-5

win32sux · 05-27-2005, 11:34 PM

BTW, there also seems to be a DoS issue fixed in bzip2 1.0.3:

Quote:

bzip2 decompression bomb vulnerability
======================================

Programs affected: bzip2 and programs which reuse bzip2
Severity: Decompression bomb leading to DoS
Discovered date: May 4th 2005
Vendor notified date: May 4th 2005
Updates being released (issue out of the bag): May 20th 2005

Whilst playing with "random bitflipping" technology, an effective decompression bomb attack against bzip2 was identified. bzip2 can be made to decompress into a file indefinitely when it encounters a suitably corrupt bzip2 archive.

This vulnerability and allegedly others are already fixed in v1.0.3. However, the uptake of v1.0.3 has been slow; there does not seem to be an awareness that v1.0.3 fixes security issues. Security updates are required and vendors need to check their codebases for static copies of bzip code.

http://scary.beasts.org/security/CESA-2005-002.txt

there's a decompression bomb demo here: http://scary.beasts.org/misc/bomb.bz2

here's the secunia advisory: http://secunia.com/advisories/15447/

and the CVE CAN: http://cve.mitre.org/cgi-bin/cvename...=CAN-2005-1260

win32sux · 06-13-2005, 06:49 PM

the issue has (finally) been addressed in slackware-current:

Quote:

Sun Jun 12 21:48:25 PDT 2005
a/bzip2-1.0.3-i486-1.tgz: Upgraded to bzip2-1.0.3.

http://www.slackware.com/changelog/current.php?cpu=i386