CVEvulnerability
CVE-2002-0760
1.2 LOW
Official page ↗
- Status
- Modified
- Published
- 2002-08-12
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 1.2 LOW — AV:L/AC:H/Au:N/C:P/I:N/A:N
Description
Race condition in bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, decompresses files with world-readable permissions before setting the permissions to what is specified in the bzip2 archive, which could allow local users to read the files as they are being decompressed.
Affected configurations
• bzip bzip2 0.9.0
• bzip bzip2 0.9.0a
• bzip bzip2 0.9.0b
• bzip bzip2 0.9.0c
• bzip bzip2 0.9.5a
• bzip bzip2 0.9.5b
• bzip bzip2 0.9.5c
• bzip bzip2 0.9.5d
• bzip bzip2 1.0
• bzip bzip2 1.0.1
Related
Referenced by CWE · observed example (1)
- CWE-689 Permission Race Condition During Resource Copy weakness
References
- ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-039.0.txt ftp.caldera.com
- ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:25.bzip2.asc Patch, Vendor Advisory
- http://www.iss.net/security_center/static/9127.php Patch, Vendor Advisory
- http://www.securityfocus.com/bid/4775 Patch, Vendor Advisory
- ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-039.0.txt ftp.caldera.com
- ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:25.bzip2.asc Patch, Vendor Advisory
- http://www.iss.net/security_center/static/9127.php Patch, Vendor Advisory
- http://www.securityfocus.com/bid/4775 Patch, Vendor Advisory