CVE-2005-2475
published 2005-08-05CVE-2005-2475: Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose…
PriorityP410low1.2CVSS 2.0
AVLACHAuNCPINAN
EPSS
0.40%
32.2th percentile
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | unzip | < unzip 5.52-4 (bookworm) | unzip 5.52-4 (bookworm) |
| info-zip | unzip | — | — |
| unzip_project | unzip | >= 0 < 5.52-4 | 5.52-4 |
| unzip_project | unzip | >= 0 < 5.52-4 | 5.52-4 |
| unzip_project | unzip | >= 0 < 5.52-4 | 5.52-4 |
| unzip_project | unzip | >= 0 < 5.52-4 | 5.52-4 |
CVSS provenance
nvdv2.01.2LOWAV:L/AC:H/Au:N/C:P/I:N/A:N
osv1.2LOW
vendor_debian1.2LOW
vendor_redhat1.2LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3m3m-6r6c-8m58: Race condition in Unzip 5
ghsa_unreviewed·2022-05-03
CVE-2005-2475 [LOW] GHSA-3m3m-6r6c-8m58: Race condition in Unzip 5
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
OSV
CVE-2005-2475: Race condition in Unzip 5
osv·2005-08-05·CVSS 1.2
CVE-2005-2475 [LOW] CVE-2005-2475: Race condition in Unzip 5
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
CISA ICS
VISAM VBASE Editor
cisa_ics·2021-11-09·CVSS 7.4
[HIGH] VISAM VBASE Editor
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
VISAM VBASE Editor
Last RevisedNovember 09, 2021
Alert CodeICSA-21-308-01
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.4
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: VISAM
- Equipment: VBASE
- Vulnerabilities: Improper Access Control, Cross-site Scripting, Improper Restriction of XML External Entity Reference, Using Components with Known Vulnerabilities
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities may allow un-neutralized user-controllable data input, disclosure of local files, access to NTLM (Windows New Technology LAN Manager) hashes
Ubuntu
unzip vulnerability
vendor_ubuntu·2005-09-30
CVE-2005-2475 unzip vulnerability
Title: unzip vulnerability
Summary: unzip vulnerability
Imran Ghory found a race condition in the handling of output files.
While a file was unpacked by unzip, a local attacker with write
permissions to the target directory could exploit this to change the
permissions of arbitrary files of the unzip user.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
security flaw
vendor_redhat·2005-08-02·CVSS 1.2
CVE-2005-2475 [LOW] security flaw
security flaw
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
Statement: This issue was addressed in unzip packages as shipped with Red Hat Enterprise Linux 3 and 4 via RHBA-2007:0418 and RHSA-2007:0203 respectively.
Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Debian
CVE-2005-2475: unzip - Race condition in Unzip 5.52 allows local users to modify permissions of arbitra...
vendor_debian·2005·CVSS 1.2
CVE-2005-2475 [LOW] CVE-2005-2475: unzip - Race condition in Unzip 5.52 allows local users to modify permissions of arbitra...
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
Scope: local
bookworm: resolved (fixed in 5.52-4)
bullseye: resolved (fixed in 5.52-4)
forky: resolved (fixed in 5.52-4)
sid: resolved (fixed in 5.52-4)
trixie: resolved (fixed in 5.52-4)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2005-2475 security flaw
bugzilla·2018-08-16·CVSS 1.2
CVE-2005-2475 [LOW] CVE-2005-2475 security flaw
CVE-2005-2475 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
---
Statement:
This issue was addressed in unzip packages as shipped with Red Hat Enterprise Linux 3 and 4 via RHBA-2007:0418 and RHSA-2007:0203 respectively.
Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
Bugzilla
CVE-2005-2475 TOCTOU issue in unzip
bugzilla·2007-02-19·CVSS 1.2
CVE-2005-2475 [LOW] CVE-2005-2475 TOCTOU issue in unzip
CVE-2005-2475 TOCTOU issue in unzip
Split for rhel3/2.1
+++ This bug was initially created as a clone of Bug #164927 +++
This issue was posted to bugtraq by Imran Ghory
http://marc.theaimsgroup.com/?l=bugtraq&m=112300046224117&w=2
If a malicious local user has write access to a directory in which a
target user is using unzip to extract a file to then a
TOCTOU bug can be exploited to change the permission of any file
belonging to that user.
On decompressing unzip copies the permissions from the compressed
file to the uncompressed file. However there is a gap between the
uncompressed file being written (and it's file handler being close)
and the permissions of the file being changed.
During this gap a malicious user can remove the decompressed file and
replace it with a hard-link to a
Bugzilla
CVE-2005-2475 TOCTOU issue in unzip
bugzilla·2007-02-01·CVSS 1.2
CVE-2005-2475 [LOW] CVE-2005-2475 TOCTOU issue in unzip
CVE-2005-2475 TOCTOU issue in unzip
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.
http://rhn.redhat.com/errata/RHBA-2007-0418.html
Bugzilla
CVE-2005-2475 TOCTOU issue in unzip
bugzilla·2005-08-02·CVSS 1.2
CVE-2005-2475 [LOW] CVE-2005-2475 TOCTOU issue in unzip
CVE-2005-2475 TOCTOU issue in unzip
This issue was posted to bugtraq by Imran Ghory
http://marc.theaimsgroup.com/?l=bugtraq&m=112300046224117&w=2
If a malicious local user has write access to a directory in which a
target user is using unzip to extract a file to then a
TOCTOU bug can be exploited to change the permission of any file
belonging to that user.
On decompressing unzip copies the permissions from the compressed
file to the uncompressed file. However there is a gap between the
uncompressed file being written (and it's file handler being close)
and the permissions of the file being changed.
During this gap a malicious user can remove the decompressed file and
replace it with a hard-link to another file belonging to the user.
unzip will then change the permissions on the hard-l
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txthttp://marc.info/?l=bugtraq&m=112300046224117&w=2http://secunia.com/advisories/16309http://secunia.com/advisories/16985http://secunia.com/advisories/17006http://secunia.com/advisories/17045http://secunia.com/advisories/17342http://secunia.com/advisories/17653http://secunia.com/advisories/25098http://securityreason.com/securityalert/32http://www.debian.org/security/2005/dsa-903http://www.info-zip.org/FAQ.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2005:197http://www.osvdb.org/18530http://www.redhat.com/support/errata/RHSA-2007-0203.htmlhttp://www.securityfocus.com/bid/14450http://www.trustix.org/errata/2005/0053/http://www.ubuntu.com/usn/usn-191-1https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/SCOSA-2005.39.txthttp://marc.info/?l=bugtraq&m=112300046224117&w=2http://secunia.com/advisories/16309http://secunia.com/advisories/16985http://secunia.com/advisories/17006http://secunia.com/advisories/17045http://secunia.com/advisories/17342http://secunia.com/advisories/17653http://secunia.com/advisories/25098http://securityreason.com/securityalert/32http://www.debian.org/security/2005/dsa-903http://www.info-zip.org/FAQ.htmlhttp://www.mandriva.com/security/advisories?name=MDKSA-2005:197http://www.osvdb.org/18530http://www.redhat.com/support/errata/RHSA-2007-0203.htmlhttp://www.securityfocus.com/bid/14450http://www.trustix.org/errata/2005/0053/http://www.ubuntu.com/usn/usn-191-1https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9975
2005-08-05
Published