漏洞信息详情

Info-ZIP UnZip 竞争条件问题漏洞

• CNNVD编号：CNNVD-200508-058
• 危害等级： 高危
  
• CVE编号： CVE-2005-2475
• 漏洞类型： 竞争条件问题
• 发布时间： 2005-08-05
• 威胁类型： 本地
• 更新时间： 2021-11-09
• 厂        商： info-zip
• 漏洞来源： disclosed this weakness.');">Imran Ghory <>

漏洞简介

Info-ZIP UnZip是美国Greg Roelofs个人开发者的一套基于Unix平台的用于对“.zip”文件格式进行解压的工具。

Info-ZIP UnZip 5.52中存在竞争条件问题漏洞，该漏洞源于竞态条件允许本地用户借助于对正在被解压文件的硬链接攻击修改任意文件的权限。当解压完成后，该文件的权限被Unzip修改。

漏洞公告

目前厂商已经发布了升级补丁以修复这个安全问题，补丁下载链接：

SCO Open Server 5.0.7

SCO 507/VOL.000.000

ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.39/507

Info-ZIP UnZip 5.50

Conectiva unzip-5.52-76281U10_2cl.i386.rpm

ftp://atualizacoes.conectiva.com.br/10/RPMS/unzip-5.52-76281U10_2cl.i3 86.rpm

Debian unzip_5.50-1woody5_arm.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 5_arm.deb

Debian unzip_5.50-1woody5_hppa.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 5_hppa.deb

Debian unzip_5.50-1woody5_i386.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 5_i386.deb

Debian unzip_5.50-1woody5_ia64.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 5_ia64.deb

Debian unzip_5.50-1woody5_m68k.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 5_m68k.deb

Debian unzip_5.50-1woody5_mips.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 5_mips.deb

Debian unzip_5.50-1woody5_mipsel.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 5_mipsel.deb

Debian unzip_5.50-1woody5_powerpc.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 5_powerpc.deb

Debian unzip_5.50-1woody5_s390.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 5_s390.deb

Debian unzip_5.50-1woody5_sparc.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 5_sparc.deb

Debian unzip_5.52-1sarge3_alpha.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.52-1sarge 3_alpha.deb

Debian unzip_5.52-1sarge3_amd64.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.52-1sarge 3_amd64.deb

Debian unzip_5.52-1sarge3_i386.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.52-1sarge 3_i386.deb

Debian unzip_5.52-1sarge3_ia64.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.52-1sarge 3_ia64.deb

Debian unzip_5.50-1woody4_alpha.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 4_alpha.deb

Debian unzip_5.50-1woody4_arm.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 4_arm.deb

Debian unzip_5.50-1woody4_hppa.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 4_hppa.deb

Debian unzip_5.50-1woody4_i386.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 4_i386.deb

Debian unzip_5.50-1woody4_ia64.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 4_ia64.deb

Debian unzip_5.50-1woody4_m68k.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 4_m68k.deb

Debian unzip_5.50-1woody4_mips.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 4_mips.deb

Debian unzip_5.50-1woody4_mipsel.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 4_mipsel.deb

Debian unzip_5.50-1woody4_powerpc.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 4_powerpc.deb

Debian unzip_5.50-1woody4_s390.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/u/unzip/unzip_5.50-1woody 4_s390.deb

Debian unzip_5.50-1woody4_sparc.deb

Debian GNU/Linux 3.0 alias woody

http://security.debian.org/pool/updates/main/

参考网址

来源:http://nvd.nist.gov/nvd.cfm?cvename=CVE-2005-2475※http://www.securityfocus.com/bid/14450

链接:无

来源:www.auscert.org.au

链接:https://www.auscert.org.au/bulletins/ESB-2021.3693

来源:www.cybersecurity-help.cz

链接:https://www.cybersecurity-help.cz/vdb/SB2021110802

受影响实体

• Info-Zip Unzip:5.52  

补丁

暂无