Debian Security Advisory

DSA-308-1 gzip -- insecure temporary files

Date Reported:

06 Jun 2003

Affected Packages:

gzip

Vulnerable:

Yes

Security database references:

In Mitre's CVE dictionary: CVE-1999-1332, CAN-2003-0367.

More information:

Paul Szabo discovered that znew, a script included in the gzip package, creates its temporary files without taking precautions to avoid a symlink attack (CAN-2003-0367).

The gzexe script has a similar vulnerability which was patched in an earlier release but inadvertently reverted.

For the stable distribution (woody) both problems have been fixed in version 1.3.2-3woody1.

For the old stable distribution (potato) CAN-2003-0367 has been fixed in version 1.2.4-33.2. This version is not vulnerable to CVE-1999-1332 due to an earlier patch.

For the unstable distribution (sid) this problem will be fixed soon.

We recommend that you update your gzip package.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Source:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1.dsc

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1.diff.gz

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2.orig.tar.gz

Alpha:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_alpha.deb

ARM:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_arm.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_ia64.deb

HPPA:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_hppa.deb

Motorola 680x0:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_m68k.deb

Big endian MIPS:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_mips.deb

Little endian MIPS:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_mipsel.deb

PowerPC:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_powerpc.deb

IBM S/390:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_s390.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_sparc.deb

Debian GNU/Linux 2.2 (potato)

Source:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2.dsc

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2.diff.gz

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4.orig.tar.gz

Alpha:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_alpha.deb

ARM:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_arm.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_i386.deb

Motorola 680x0:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_m68k.deb

PowerPC:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_powerpc.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_sparc.deb

MD5 checksums of the listed files are available in the original advisory.