ArchLinux: 202204-7: gzip: arbitrary command execution | LinuxSecur...

Advisories

Arch Linux Security Advisory ASA-202204-7
=========================================

Severity: High
Date    : 2022-04-07
CVE-ID  : CVE-2022-1271
Package : gzip
Type    : arbitrary command execution
Remote  : No
Link    : https://security.archlinux.org/AVG-2666

Summary
=======

The package gzip before version 1.12-1 is vulnerable to arbitrary
command execution.

Resolution
==========

Upgrade to 1.12-1.

# pacman -Syu "gzip>=1.12-1"

The problem has been fixed upstream in version 1.12.

Workaround
==========

None.

Description
===========

Malicious filenames with two or more newlines can make zgrep and xzgrep
to write to arbitrary files or (with a GNU sed extension) lead to
arbitrary code execution. The issue with the old code is that with
multiple newlines, the N-command will read the second line of input,
then the s-commands will be skipped because it's not the end of  the
file yet, then a new sed cycle starts and the pattern space is printed
and emptied. So only the last line or two get escaped.

Impact
======

An attacker is able to provide malicious filenames to write to
arbitrary files or execute arbitrary commands on the affected host.

References
==========

https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=dc9740df61e575e8c3148b7bd3c147a81ea00c7c
https://savannah.gnu.org/forum/forum.php?forum_id=10157
https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f0589cb63d6
https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch
https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch.sig
https://security.archlinux.org/CVE-2022-1271

ArchLinux: 202204-7: gzip: arbitrary command execution

April 12, 2022
The package gzip before version 1.12-1 is vulnerable to arbitrary command execution

Summary

Malicious filenames with two or more newlines can make zgrep and xzgrep to write to arbitrary files or (with a GNU sed extension) lead to arbitrary code execution. The issue with the old code is that with multiple newlines, the N-command will read the second line of input, then the s-commands will be skipped because it's not the end of the file yet, then a new sed cycle starts and the pattern space is printed and emptied. So only the last line or two get escaped.

Resolution

Upgrade to 1.12-1.
# pacman -Syu "gzip>=1.12-1"
The problem has been fixed upstream in version 1.12.

References

https://git.savannah.gnu.org/cgit/gzip.git/commit/?id=dc9740df61e575e8c3148b7bd3c147a81ea00c7c https://savannah.gnu.org/forum/forum.php?forum_id=10157 https://git.tukaani.org/?p=xz.git;a=commit;h=69d1b3fc29677af8ade8dc15dba83f0589cb63d6 https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch.sig https://security.archlinux.org/CVE-2022-1271

Severity
CVE-ID : CVE-2022-1271
Package : gzip
Type : arbitrary command execution
Remote : No
Link : https://security.archlinux.org/AVG-2666

Impact

An attacker is able to provide malicious filenames to write to arbitrary files or execute arbitrary commands on the affected host.

Workaround

None.

Related News

© 2022 Guardian Digital, Inc All Rights Reserved

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.