CVE-2002-0761
Summary
| CVE | CVE-2002-0761 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2002-08-12 04:00:00 UTC |
| Updated | 2008-09-05 20:28:00 UTC |
| Description | bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead of the actual files when creating an archive, which could cause the files to be extracted with less restrictive permissions than intended. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Bzip | Bzip2 | 0.9.0 | All | All | All |
| Application | Bzip | Bzip2 | 0.9.0a | All | All | All |
| Application | Bzip | Bzip2 | 0.9.0b | All | All | All |
| Application | Bzip | Bzip2 | 0.9.0c | All | All | All |
| Application | Bzip | Bzip2 | 0.9.5a | All | All | All |
| Application | Bzip | Bzip2 | 0.9.5b | All | All | All |
| Application | Bzip | Bzip2 | 0.9.5c | All | All | All |
| Application | Bzip | Bzip2 | 0.9.5d | All | All | All |
| Application | Bzip | Bzip2 | 1.0 | All | All | All |
| Application | Bzip | Bzip2 | 1.0.1 | All | All | All |
| Application | Bzip | Bzip2 | 0.9.0 | All | All | All |
| Application | Bzip | Bzip2 | 0.9.0a | All | All | All |
| Application | Bzip | Bzip2 | 0.9.0b | All | All | All |
| Application | Bzip | Bzip2 | 0.9.0c | All | All | All |
| Application | Bzip | Bzip2 | 0.9.5a | All | All | All |
| Application | Bzip | Bzip2 | 0.9.5b | All | All | All |
| Application | Bzip | Bzip2 | 0.9.5c | All | All | All |
| Application | Bzip | Bzip2 | 0.9.5d | All | All | All |
| Application | Bzip | Bzip2 | 1.0 | All | All | All |
| Application | Bzip | Bzip2 | 1.0.1 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| ISS X-Force Database: bzip2-compression-symlink (9128): bzip2 compressed files could inherit the permissions of a symbolic link | XF | www.iss.net | Patch, Vendor Advisory |
| bzip2 Archive Inherited Symbolic Link Permissions Vulnerability | BID | www.securityfocus.com | Patch, Vendor Advisory |
| CSSA-2002-039.0 | CALDERA | ftp.caldera.com | |
| FreeBSD-SA-02:25 | FREEBSD | ftp.freebsd.org | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.