Security Advisory (MDKSA-2003:073): unzip

[aru]

MandrakeSoft Security Advisory MDKSA-2003:073 : unzip

 

July 7th, 2003

Updated unzip packages fix vulnerability

 

A vulnerability was discovered in unzip 5.50 and earlier that allows attackers to overwrite arbitrary files during archive extraction by placing non-printable characters between two "." characters. These invalid characters are filtered which results in a ".." sequence.

 

The patch applied to these packages prevents unzip from writing to parent directories unless the "-:" command line option is used.

 

 

The released versions of Mandrake GNU/Linux affected are:

• 8.2

 

[*] 9.0

 

[*] 9.1

 

[*] Multi Network Firewall 8.2

 

[*] Corporate Server 2.1

Full information about this advisory, including the updated packages, is available at:

www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:073

 

Other references:

http://cve.mitre.org/cgi-bin/cvename.cgi?n...e=CAN-2003-0282

http://marc.theaimsgroup.com/?l=bugtraq&m=...105259038503175

 

Posted automatically by aru (mdksec2mub v0.0.6)