CVE-2005-0602 Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges.
MediumCVSS 6.2
EPSS 0.40%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Unzip 5.51 and earlier does not properly warn the user when extracting setuid or setgid files, which may allow local users to gain privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| info-zip unzip | <= 5.51 | No fix listed |
| info-zip unzip | = 5.50 | No fix listed |
| debian/unzip(Debian:12) | < 5.52-1 | 5.52-1 |
| debian/unzip(Debian:13) | < 5.52-1 | 5.52-1 |
| debian/unzip(Debian:14) | < 5.52-1 | 5.52-1 |
References
- 20050228 7a69Adv#22 - UNIX unzip keep setuid and setgid files mailing-list
- 17045 third-party-advisory
- 17342 third-party-advisory
- 27684 third-party-advisory
- 103150 vendor-advisory
- 200844 vendor-advisory
- www.info-zip.org
- MDKSA-2005:197 vendor-advisory
- 14447 vdb-entry
- 2005-0053 vendor-advisory
- ADV-2007-3866 vdb-entry
- Debian Security Tracker CVE-2005-0602 vendor-advisory