Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete.

The remote host is running a version of Mac OS X 10.4 that is older than version 10.4.11 or a version of Mac OS X 10.3 that does not have Security Update 2007-008 applied.  This update contains several security fixes for the following programs :


 - Flash Player Plugin
 - AppleRAID
 - BIND
 - bzip2
 - CFFTP
 - CFNetwork
 - CoreFoundation
 - CoreText
 - Kerberos
 - Kernel
 - remote_cmds
 - Networking
 - NFS
 - NSURL
 - Safari
 - SecurityAgent
 - WebCore
 - WebKit

The remote host is running a version of Mac OS X 10.4 which is older than version 10.4.11 or a version of Mac OS X 10.3 which does not have Security Update 2007-008 applied. 

This update contains several security fixes for the following programs :

 - Flash Player Plugin
 - AppleRAID
 - BIND
 - bzip2
 - CFFTP
 - CFNetwork
 - CoreFoundation
 - CoreText
 - Kerberos
 - Kernel
 - remote_cmds
 - Networking
 - NFS
 - NSURL
 - Safari
 - SecurityAgent
 - WebCore
 - WebKit

Updated bzip2 packages that fix multiple issues are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

[Updated 13 February 2006] Replacement bzip2 packages for Red Hat Enterprise Linux 4 have been created as the original erratum packages did not fix CVE-2005-0758.

Bzip2 is a data compressor.

A bug was found in the way bzgrep processes file names. If a user can be tricked into running bzgrep on a file with a carefully crafted file name, arbitrary commands could be executed as the user running bzgrep.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0758 to this issue.

A bug was found in the way bzip2 modifies file permissions during decompression. If an attacker has write access to the directory into which bzip2 is decompressing files, it is possible for them to modify permissions on files owned by the user running bzip2 (CVE-2005-0953).

A bug was found in the way bzip2 decompresses files. It is possible for an attacker to create a specially crafted bzip2 file which will cause bzip2 to cause a denial of service (by filling disk space) if decompressed by a victim (CVE-2005-1260).

Users of Bzip2 should upgrade to these updated packages, which contain backported patches to correct these issues.

A bug was found in the way that bzgrep processed file names. If a user could be tricked into running bzgrep on a file with a special file name, it would be possible to execute arbitrary code with the privileges of the user running bzgrep.

As well, the bzip2 package provided with Mandriva Linux 2006 did not the patch applied to correct CVE-2005-0953 which was previously fixed by MDKSA-2005:091; those packages are now properly patched.

The updated packages have been patched to correct these problems.

Imran Ghory discovered a race condition in the file permission restore code of bunzip2. While a user was decompressing a file, a local attacker with write permissions in the directory of that file could replace the target file with a hard link. This would cause bzip2 to restore the file permissions to the hard link target instead of to the bzip2 output file, which could be exploited to gain read or even write access to files of other users. (CAN-2005-0953)

Specially crafted bzip2 archives caused an infinite loop in the decompressor which resulted in an indefinitively large output file ('decompression bomb'). This could be exploited to a Denial of Service attack due to disk space exhaustion on systems which automatically process user-supplied bzip2 compressed files. (CAN-2005-1260).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Problem Description Two problems have been discovered relating to the extraction of bzip2-compressed files. First, a carefully constructed invalid bzip2 archive can cause bzip2 to enter an infinite loop.
Second, when creating a new file, bzip2 closes the file before setting its permissions. Impact The first problem can cause bzip2 to extract a bzip2 archive to an infinitely large file. If bzip2 is used in automated processing of untrusted files this could be exploited by an attacker to create an denial-of-service situation by exhausting disk space or by consuming all available cpu time.

The second problem can allow a local attacker to change the permissions of local files owned by the user executing bzip2 providing that they have write access to the directory in which the file is being extracted. Workaround Do not uncompress bzip2 archives from untrusted sources and do not uncompress files in directories where untrusted users have write access.

Imran Ghory discovered a race condition in bzip2, a high-quality block-sorting file compressor and decompressor. When decompressing a file in a directory an attacker has access to, bunzip2 could be tricked to set the file permissions to a different file the user has permissions to.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:474 advisory.

  - security flaw (CVE-2005-0758, CVE-2005-0953, CVE-2005-1260)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A race condition in the file permission restore code of bunzip2 was discovered by Imran Ghory. While a user was decompressing a file, a local attacker with write permissions to the directory containing the compressed file could replace the target file with a hard link which would cause bunzip2 to restore the file permissions of the original file to the hard link target. This could be exploited to gain read or write access to files of other users (CVE-2005-0953).

A vulnerability was found where specially crafted bzip2 archives would cause an infinite loop in the decompressor, resulting in an indefinitively large output file (also known as a 'decompression bomb'). This could be exploited to cause a Denial of Service attack on the host computer due to disk space exhaustion (CVE-2005-1260).

The provided packages have been patched to correct these issues.

ID	Name	Product	Family	Severity
4284	Mac OS X < 10.4.11 Multiple Vulnerabilities (Security Update 2007-008)	Nessus Network Monitor	Operating System Detection	critical
28212	Mac OS X < 10.4.11 Multiple Vulnerabilities (Security Update 2007-008)	Nessus	MacOS X Local Security Checks	critical
21829	CentOS 3 / 4 : bzip2 (CESA-2005:474)	Nessus	CentOS Local Security Checks	medium
20831	Mandrake Linux Security Advisory : bzip2 (MDKSA-2006:026)	Nessus	Mandriva Local Security Checks	medium
20517	Ubuntu 4.10 / 5.04 : bzip2 vulnerabilities (USN-127-1)	Nessus	Ubuntu Local Security Checks	medium
18853	FreeBSD : bzip2 -- denial of service and permission race vulnerabilities (197f444f-e8ef-11d9-b875-0001020eed82)	Nessus	FreeBSD Local Security Checks	medium
18517	Debian DSA-730-1 : bzip2 - race condition	Nessus	Debian Local Security Checks	low
18510	RHEL 4 : bzip2 (RHSA-2005:474)	Nessus	Red Hat Local Security Checks	medium
18307	Mandrake Linux Security Advisory : bzip2 (MDKSA-2005:091)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2005-0953

medium

Tenable Plugins

critical

critical

medium

medium

medium

medium

low

medium

medium