Nessus Plugin #15145

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

[DSA308] DSA-308-1 gzip

Family:

Debian Local Security Checks

Category:

infos

Copyright:

This script is (C) 2004 Michel Arboi

Summary:

DSA-308-1 gzip

Version:

$Revision: 1.4 $

Cve_id:

CAN-2003-0367, CVE-1999-1332

Bugtraq_id:

7845, 7872

Xrefs:

DSA:308

Description:

Paul Szabo discovered that znew, a script included in the gzip
package, creates its temporary files without taking precautions to
avoid a symlink attack (CAN-2003-0367).
The gzexe script has a similar vulnerability which was patched in an
earlier release but inadvertently reverted.
For the stable distribution (woody) both problems have been fixed in
version 1.3.2-3woody1.
For the old stable distribution (potato) CAN-2003-0367 has been fixed
in version 1.2.4-33.2. This version is not vulnerable to
CVE-1999-1332 due to an earlier patch.
For the unstable distribution (sid) this problem will be fixed soon.
We recommend that you update your gzip package.


Solution : http://www.debian.org/security/2003/dsa-308
Risk factor : High