Note: This is an archival copy of Security Sun Alert 200844 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000637.1.
Solaris 9 Operating System
Solaris 10 Operating System
Solaris 8 Operating System
Date of Workaround Release
Date of Resolved Release
A security vulnerability in the unzip(1L) command may set unintended permissions on extracted files. This may allow a local unprivileged user to execute arbitrary code with the privileges of another user who runs the unzip command to extract files from a specially crafted unzip archive.
This issue is also referenced in the following document:
CVE-2005-0602 at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0602
This issue can occur in the following releases:
Note: This issue affects versions of the unzip(1L) command prior to 5.52. The following command can be used to determine the version of unzip that is installed on a system:
$ unzip -v UnZip 5.32 of 3 November 1997, by Info-ZIP. Maintained by Greg Roelofs. Send bug reports to the authors at Zip-Bugs@lists.wku.edu; see README for details. [...]
This issue is exploited by creating archives which contain executable files with a set-id bit set (see chmod(2)). As a result, files that are extracted from an archive that has been specially crafted to exploit this issue will have this bit set when extracted on filesystems which allow this. The ls(1) command can be used to display the permissions of a newly extracted file, as in the following example:
$ ls -l test -r-sr-xr-x 1 testu staff 10280 Nov 9 17:56 test
The 's' in the user permissions section of the above output indicates this file has the "set-user-id" bit set.
It is recommended that archives from untrusted sources not be extracted using the unzip(1L) command until patches can be applied. The unzip(1L) command can be disabled entirely by removing executable permissions from the file, for example by using the chmod(1) command as follows (as the user "root"):
# chmod a-x /usr/bin/unzip
This issue is addressed in the following releases:
This solution has no attachment