CVE-2005-2475 Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after t...
LowCVSS 1.2
EPSS 0.40%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by Unzip after the decompression is complete.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| info-zip unzip | = 5.52 | No fix listed |
| debian/unzip(Debian:12) | < 5.52-4 | 5.52-4 |
| debian/unzip(Debian:13) | < 5.52-4 | 5.52-4 |
| debian/unzip(Debian:14) | < 5.52-4 | 5.52-4 |
References
- 20050801 unzip TOCTOU file-permissions vulnerability mailing-list
- 16309 third-party-advisory
- 16985 third-party-advisory
- 17006 third-party-advisory
- 17045 third-party-advisory
- 17342 third-party-advisory
- 17653 third-party-advisory
- 25098 third-party-advisory
- 32 third-party-advisory
- DSA-903 vendor-advisory
- www.info-zip.org
- MDKSA-2005:197 vendor-advisory
- 18530 vdb-entry
- RHSA-2007:0203 vendor-advisory
- 14450 vdb-entry
- 2005-0053 vendor-advisory
- USN-191-1 vendor-advisory
- oval:org.mitre.oval:def:9975 signature vdb-entry
- Debian Security Tracker CVE-2005-2475 vendor-advisory
- bugs.debian.org issue-tracking