fkie_cve-2002-0759
Vulnerability from fkie_nvd
Published
2002-08-12 04:00
Modified
2024-11-20 23:39
Severity ?
Summary
bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, does not use the O_EXCL flag to create files during decompression and does not warn the user if an existing file would be overwritten, which could allow attackers to overwrite files via a bzip2 archive.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bzip:bzip2:0.9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "325C63C7-740D-42E1-B8B1-51125DE57F61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bzip:bzip2:0.9.0a:*:*:*:*:*:*:*",
"matchCriteriaId": "550690C7-32D0-4126-B272-D2254A2EF434",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bzip:bzip2:0.9.0b:*:*:*:*:*:*:*",
"matchCriteriaId": "DFE746CF-6890-4259-A9DB-5F77B592D1E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bzip:bzip2:0.9.0c:*:*:*:*:*:*:*",
"matchCriteriaId": "6C95FE39-842A-45D1-A858-D438C0C15B99",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bzip:bzip2:0.9.5a:*:*:*:*:*:*:*",
"matchCriteriaId": "D8AD6CE9-FCE5-4926-A1D1-0706DFE4A6D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bzip:bzip2:0.9.5b:*:*:*:*:*:*:*",
"matchCriteriaId": "D54DD36D-7A6C-4649-855A-D81F29FFB6C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bzip:bzip2:0.9.5c:*:*:*:*:*:*:*",
"matchCriteriaId": "0B87D623-6CF8-4BDB-A9FB-CF07589AF1CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bzip:bzip2:0.9.5d:*:*:*:*:*:*:*",
"matchCriteriaId": "5FE3BFE7-75B6-4284-9EDC-78D452CD9174",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bzip:bzip2:1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B10B3BF9-BE42-468D-89E8-8D4A5FEDC734",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:bzip:bzip2:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E55F00B1-D48B-40A6-872F-959598D7E6E4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, does not use the O_EXCL flag to create files during decompression and does not warn the user if an existing file would be overwritten, which could allow attackers to overwrite files via a bzip2 archive."
},
{
"lang": "es",
"value": "bzip2 anteriores a 1.0.2 en FreeBSD 4.5 y anteriores, y otros Sistemas Operativos, no usan la etiqueta O_EXCL para crear ficheros durante la descomprensi\u00f3n y no alertan al usuario de que un fichero ya existente podr\u00eda ser sobreescrito, lo cual podr\u00eda permitir a atacantes remotos la sobreescritura de ficheros mediante un archivo bzip2."
}
],
"id": "CVE-2002-0759",
"lastModified": "2024-11-20T23:39:48.273",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2002-08-12T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-039.0.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:25.bzip2.asc"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/9126.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/4774"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-039.0.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:25.bzip2.asc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/9126.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/4774"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.