[Slackit.org] [slackware-security] unzip vulnerability patched (SSA:2003-237-01)

[Andrea Guarnaccia]

> [slackware-security]  unzip vulnerability patched (SSA:2003-237-01)
>
> Upgraded infozip packages are available for Slackware 9.0 and -current.
> These fix a security issue where a specially crafted archive may
> overwrite files (including system files anywhere on the filesystem)
> upon extraction by a user with sufficient permissions.
>
> For more information, see:
>
> http://www.securityfocus.com/bid/7550
> http://lwn.net/Articles/38540/
> http://xforce.iss.net/xforce/xfdb/12004
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0282
>
>
> Here are the details from the Slackware 9.0 ChangeLog:
> +--------------------------+
> Mon Aug 25 15:35:28 PDT 2003
> patches/packages/infozip-5.50-i486-2.tgz:  Fixed a bug where a specially
>   crafted archive might try to write to ../ or ../../, etc, potentially
>   overwriting system files if the user (such as root) has permissions to
>   overwrite them.  Thanks to jelmer for locating this problem, and
>   Ben Laurie for providing a patch.
>   (* Security fix *)
> +--------------------------+
>
>
>
> WHERE TO FIND THE NEW PACKAGES:
> +-----------------------------+
>
> Updated package for Slackware 9.0:
> ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/infozip-5.50-i386-2.tgz
>
> Updated package for Slackware -current:
> ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/a/infozip-5.50-i486-2.tgz
>
>
>
> MD5 SIGNATURES:
> +-------------+
>
> Slackware 9.0 package:
> d262ae0564f475b39e2ccf20fe1dfc41  infozip-5.50-i386-2.tgz
>
> Slackware -current package:
> 8c4b4fc48e145a71e962cd7f99be8a5b  infozip-5.50-i486-2.tgz
>
>
>
> INSTALLATION INSTRUCTIONS:
> +------------------------+
>
> Upgrade using upgradepkg (as root):
> upgradepkg infozip-5.50-i386-2.tgz
>
>
>
> +-----+
>
> Slackware Linux Security Team
> http://slackware.com/gpg-key
> address@hidden