pigz CVE-2015-1191 Multiple Directory Traversal Vulnerabilities

Bugtraq ID:	72109
Class:	Input Validation Error
CVE:	CVE-2015-1191
Remote:	Yes
Local:	No
Published:	Jan 19 2015 12:00AM
Updated:	Oct 26 2016 05:01AM
Credit:	Alexander Cherepanov
Vulnerable:	pigz pigz 2.3.1-1 IBM PowerKVM 2.1.1 SP3 IBM PowerKVM 2.1.1 Build 65.7 IBM PowerKVM 2.1.1 Build 65.6 IBM PowerKVM 2.1.1 Build 65.5 IBM PowerKVM 2.1.1 Build 65.4 IBM PowerKVM 2.1.1 build 57 IBM PowerKVM 3.1.0.2 Update 1 IBM PowerKVM 3.1.0.2 IBM PowerKVM 3.1 SP2 IBM PowerKVM 3.1 SP1 IBM PowerKVM 3.1 Build 3 IBM PowerKVM 3.1 Build 2 IBM PowerKVM 3.1 IBM PowerKVM 2.1.1.3-65.11 IBM PowerKVM 2.1.1.3-65.10 IBM PowerKVM 2.1.1.3-65 IBM PowerKVM 2.1.1 SP2 (build 51) IBM PowerKVM 2.1.1 Build 65.1 IBM PowerKVM 2.1.1 build 58 IBM PowerKVM 2.1
Not Vulnerable:	pigz pigz 2.3.1-2 IBM PowerKVM 3.1.0.2 Update 2 IBM PowerKVM 2.1.1.3-65.12

pigz CVE-2015-1191 Multiple Directory Traversal Vulnerabilities

pigz is prone to multiple directory-traversal vulnerabilities.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to read arbitrary files in the context of the application. This may aid in further attacks.

pigz CVE-2015-1191 Multiple Directory Traversal Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

pigz CVE-2015-1191 Multiple Directory Traversal Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

pigz CVE-2015-1191 Multiple Directory Traversal Vulnerabilities

References:

• pigz Homepage (pigz)
  
• When decompressing with -N or -NT, strip any path from header name. (pigz)
  
• isg3T1024213: A vulnerability in pigz affects PowerKVM (CVE-2015-1191) (IBM)
  
• pigz: CVE-2015-1191: directory traversal vulnerability (Debian)