Paketname
unzip
Datum
2003-08-19
Advisory ID
MDKSA-2003:073-1
Betroffene Versionen
9.1 i586 , CS2.1 x86_64 , CS2.1 i586 , 9.0 i586 , 8.2 i586 , MNF8.2 i586 , 9.1 i586 , 8.2 i586

Problembeschreibung

A vulnerability was discovered in unzip 5.50 and earlier that allows attackers to overwrite arbitrary files during archive extraction by placing non-printable characters between two "." characters. These invalid characters are filtered which results in a ".." sequence. The patch applied to these packages prevents unzip from writing to parent directories unless the "-:" command line option is used. Update: Ben Laurie found that the original patch used to fix this issue missed a case where the path component included a quoted slash. An updated patch was used to build these packages.

Aktualisierte Pakete

9.1 i586

 32f6a6726eb9cfe5d76aec74a71228d1  9.1/RPMS/unzip-5.50-4.2mdk.i586.rpm
ece7c5edb30cb80c00e902a61126e68d  9.1/SRPMS/unzip-5.50-4.2mdk.src.rpm

CS2.1 x86_64

 53ecb5284909bec78ef0b570dfbabf89  x86_64/corporate/2.1/RPMS/unzip-5.50-4.2mdk.x86_64.rpm
ece7c5edb30cb80c00e902a61126e68d  x86_64/corporate/2.1/SRPMS/unzip-5.50-4.2mdk.src.rpm

CS2.1 i586

 eb83a1f819f0407da2a6abe8f9470e6d  corporate/2.1/RPMS/unzip-5.50-4.2mdk.i586.rpm
ece7c5edb30cb80c00e902a61126e68d  corporate/2.1/SRPMS/unzip-5.50-4.2mdk.src.rpm

9.0 i586

 eb83a1f819f0407da2a6abe8f9470e6d  9.0/RPMS/unzip-5.50-4.2mdk.i586.rpm
ece7c5edb30cb80c00e902a61126e68d  9.0/SRPMS/unzip-5.50-4.2mdk.src.rpm

8.2 i586

 da00ebf987ca4200ce2ed926bf4adaeb  8.2/RPMS/unzip-5.50-4.2mdk.i586.rpm
ece7c5edb30cb80c00e902a61126e68d  8.2/SRPMS/unzip-5.50-4.2mdk.src.rpm

MNF8.2 i586

 da00ebf987ca4200ce2ed926bf4adaeb  mnf8.2/RPMS/unzip-5.50-4.2mdk.i586.rpm
ece7c5edb30cb80c00e902a61126e68d  mnf8.2/SRPMS/unzip-5.50-4.2mdk.src.rpm

9.1 i586

 c4cc4eb7e92026ce5264daa57a42ce98  ppc/9.1/RPMS/unzip-5.50-4.2mdk.ppc.rpm
ece7c5edb30cb80c00e902a61126e68d  ppc/9.1/SRPMS/unzip-5.50-4.2mdk.src.rpm

8.2 i586

 07252553006b6d428289f4fdfadf46fd  ppc/8.2/RPMS/unzip-5.50-4.2mdk.ppc.rpm
ece7c5edb30cb80c00e902a61126e68d  ppc/8.2/SRPMS/unzip-5.50-4.2mdk.src.rpm

Referenzen