__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Sun Linux Vulnerabilities in "unzip" and GNU "tar" Commands [Sun Alert ID: 47800 ] February 7, 2003 13:00 GMT Number N-041 ______________________________________________________________________________ PROBLEM: Vulnerabilities have been identified in "unzip" and GNU "tar" Commands. Directory traversal vulnerability in Info-ZIP UnZip 5.42 and earlier allows attackers to overwrite arbitrary files during archive extraction via a .. (dot dot) in an extracted filename. PLATFORM: Sun Linus Sun Linux 5.0 with tar 1.13.19-6 Sun Linux 5.0 with unzip version 5.42 or earlier Sun Linux 5.0 with GNU tar 1.13.19 or earlier Cobalt Qube 3 RaQ 3 RaQ 4 RaQ 550 RaQ XTR DAMAGE: A local unprivileged user may be able to gain unauthorized root access and/or overwrite any file on the system. SOLUTION: Apply available patches, upgrades, or workarounds. ______________________________________________________________________________ VULNERABILITY The risk is MEDIUM. There are no reliable symptoms that would ASSESSMENT: show the described issue has been exploited to gain unauthorized root access to a system. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/n-041.shtml ORIGINAL BULLETIN: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert% 2F47800&zone_32=category%3Asecurity PATCHES: http://sunsolve.sun.com/patches/linux/security.html http://sunsolve.sun.com/patches/cobalt/ ______________________________________________________________________________ [***** Start Sun Alert ID: 47800 *****] Sun Alert ID: 47800 Synopsis: Sun Linux Vulnerabilities in "unzip" and GNU "tar" Commands Category: Security Product: Sun Linux BugIDs: 16170 Avoidance: Workaround, Patch, Upgrade State: Resolved Date Released: 10-Oct-2002, 04-Feb-2003 Date Closed: 04-Feb-2003 Date Modified: 04-Feb-2003 1. Impact A local unprivileged user may be able to gain unauthorized root access and/or overwrite any file on the system if a privileged user extracts a tar or zip archive which contains a ".." (dot dot) in the filename. For more information see: http://online.securityfocus.com/archive/1/196445 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1267 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1268 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1269 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0399 2. Contributing Factors This issue can occur in the following releases: Sun Linux Sun Linux 5.0 with tar 1.13.19-6 Sun Linux 5.0 with unzip version 5.42 or earlier Sun Linux 5.0 with GNU tar 1.13.19 or earlier Note: Sun Linux 5.0 is currently shipped with the Sun LX50 Server. Cobalt Qube 3 RaQ 3 RaQ 4 RaQ 550 RaQ XTR 3. Symptoms There are no reliable symptoms that would show the described issue has been exploited to gain unauthorized root access to a system. Solution Summary Top 4. Relief/Workaround Verify zip or tar archives using the options as follows: tar -tvf .tar Or for compressed files: tar -tvzf .tar. Or for zip files: unzip -l .zip If multiple "../" entries are not present, the archive is safe. 5. Resolution This issue is addressed in the following releases: Sun Linux Sun Linux 5.0 tar-1.13.25-4.7.1.i386.rpm Sun Linux 5.0 unzip-5.50-2.i386.rpm Sun Linux 5.0 tar-1.13.25-4.7.1.src.rpm Sun Linus 5.0 unzip-5.50-2.src.rpm The above patches are available at: http://sunsolve.sun.com/patches/linux/security.html Cobalt Qube3-All-Security-4.0.1-16170.pkg RaQ3-All-Security-5.0.1-16170.pkg RaQ4-All-Security-2.0.2-16170.pkg RaQ550-All-Security-0.0.1-16170.pkg RaQXTR-All-Security-1.0.1-16170.pkg The above patches are available at http://sunsolve.sun.com/patches/cobalt/. Change History 04-Feb-2003: State Resolved (and Closed) Updated Contributing Factors and Resolution sections This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements. Copyright 2000-2003 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved. [***** End Sun Alert ID: 47800 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Sun Microsystems for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) N-031: Buffer Overflows in ISC DHCPD Minires Library N-032: Double-Free Bug in Concurrent Versions System (CVS) Server N-033: Unchecked Buffer in Locator Service Vulnerability N-034: Cumulative Patch for Microsoft Content Management Server N-035: Microsoft V1 Exchange Server Security Certificates Vulnerability N-036: Updated kerberos packages fix vulnerability in ftp client N-037: Multiple Vulnerabilities in Old Releases of MIT Kerberos N-038: Microsoft Cumulative Patch for Internet Explorer N-039: Microsoft Unchecked Buffer in Windows Redirector Vulnerability N-040: Red Hat Xpdf Packages Vulnerability