Vulnerability Note VU#635998

Sun Solaris gzip may change permissions of hard linked files

Overview

Sun Solaris gzip contains a vulnerability that may change the permissions of hard linked files. The specific impact may allow hard linked files compressed by gzip to become readable and able to be modified by unprivileged users.

I. Description

Gzip is a utility used for compressing and decompressing files. The "-f" (-force) flag is used to force compression or decompression even if the file has multiple hard links. When gzip is used with the "-f" flag on a Sun Solaris 8 machine, it may change the permissions of a hard linked file to 0777, causing a hard link to become readable and able to be modified by unprivileged users, regardless of its previous permission settings.

Note that Solaris 7 and Solaris 9 are not affected by this issue. This vulnerability is only present in versions of gzip prior to 1.3.

The following describes the symptoms of the vulnerability (example provided by the SunSolve Alert) :

$ ln original-file hardlink $ls -l original-file hardlink -rw-r--r-- 2 user staff 293 Jun 24 18:33 hardlink -rw-r--r-- 2 user staff 293 Jun 24 18:33 original-file $gzip -f original-file $ls -l original-file* hardlink -rwxrwxrwx 1 user staff 293 Jun 24 18:33 hardlink -rw-r--r-- 1 user staff 195 Jun 24 18:33 original-file.gz

II. Impact

Local unprivileged users may be able to read or modify files owned by the user who has invoked gzip as described. Access to system files may inadvertently be granted if the gzip command is issued by a local privileged user.

III. Solution

Apply a patch

SPARC platform

112668-02

x86 platform

112669-02

Do not use the force option for gzip

Per Sun Alert ID 57600, avoid using the "-f" or "-force" option with the vulnerable gzip command to work around the problem.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Sun Microsystems Inc.	Vulnerable	12-Oct-2004

References

http://sunsolve.sun.com/search/document.do?assetkey=1-26-57600-1
http://secunia.com/advisories/12744/
http://www.securityfocus.com/bid/11318
http://xforce.iss.net/xforce/xfdb/17577
http://www.osvdb.org/displayvuln.php?osvdb_id=10511

Credit

This document was written by Will Dormann and is based on the information presented in the Sun Alert notification.

Other Information

Date Public:	2004-10-01
Date First Published:	2004-10-12
Date Last Updated:	2004-10-18
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	3.88
Document Revision:	9

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader