Vulnerability Name:

CVE-2005-0758 (CCN-20539)

Assigned:2005-04-22
Published:2005-04-22
Updated:2019-10-16
Summary:zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.
CVSS v3 Severity:5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:File Manipulation
References:Source: SCO
Type: Third Party Advisory
SCOSA-2005.58

Source: SGI
Type: Third Party Advisory
20060301-01-U

Source: CCN
Type: Bugzilla Bug 90626
app-arch/gzip zgrep issue (CAN-2005-0758)

Source: MISC
Type: Third Party Advisory
http://bugs.gentoo.org/show_bug.cgi?id=90626

Source: MITRE
Type: CNA
CVE-2005-0758

Source: CCN
Type: Apple Security Update 2007-007
About Security Update 2007-007

Source: CONFIRM
Type: Third Party Advisory
http://docs.info.apple.com/article.html?artnum=306172

Source: CCN
Type: Apple Web site
Apple security updates

Source: APPLE
Type: Mailing List, Third Party Advisory
APPLE-SA-2007-07-31

Source: CCN
Type: RHSA-2005-357
gzip security update

Source: REDHAT
Type: Third Party Advisory
RHSA-2005:357

Source: CCN
Type: RHSA-2005-474
bzip2 security update

Source: SECUNIA
Type: Third Party Advisory
18100

Source: SECUNIA
Type: Third Party Advisory
19183

Source: SECUNIA
Type: Third Party Advisory
22033

Source: CCN
Type: SA26235
Mac OS X Security Update Fixes Multiple Vulnerabilities

Source: SECUNIA
Type: Third Party Advisory
26235

Source: CCN
Type: SECTRACK ID: 1013928
Gzip zgrep Implementation May Let Remote Users Execute Arbitrary Commands

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1013928

Source: SLACKWARE
Type: Third Party Advisory
SSA:2006-262

Source: CCN
Type: ASA-2006-040
Gzip Multiple Vulnerabilities (SCOSA-2005.58)

Source: FEDORA
Type: Broken Link, Permissions Required
FLSA:158801

Source: CCN
Type: GLSA-200505-05
gzip: Multiple vulnerabilities

Source: GENTOO
Type: Patch, Third Party Advisory
GLSA-200505-05

Source: CCN
Type: gzip Home page
The gzip home page

Source: MANDRIVA
Type: Third Party Advisory
MDKSA-2006:026

Source: MANDRIVA
Type: Third Party Advisory
MDKSA-2006:027

Source: CCN
Type: OpenPKG-SA-2007.002
bzip2

Source: OPENPKG
Type: Third Party Advisory
OpenPKG-SA-2007.002

Source: OSVDB
Type: Broken Link
16371

Source: CCN
Type: OSVDB ID: 16371
zgrep Unspecified Arbitrary Command Execution

Source: REDHAT
Type: Third Party Advisory
RHSA-2005:474

Source: BID
Type: Third Party Advisory, VDB Entry
13582

Source: CCN
Type: BID-13582
Gzip Zgrep Arbitrary Command Execution Vulnerability

Source: BID
Type: Third Party Advisory, VDB Entry
25159

Source: CCN
Type: BID-25159
Apple Mac OS X 2007-007 Multiple Security Vulnerabilities

Source: CCN
Type: TLSA-2005-59
Multiple vulnerabilities exist in gzip

Source: CCN
Type: USN-158-1
gzip utility vulnerability

Source: UBUNTU
Type: Third Party Advisory
USN-158-1

Source: CCN
Type: USN-161-1
bzip2 utility vulnerability

Source: VUPEN
Type: Third Party Advisory
ADV-2007-2732

Source: XF
Type: Third Party Advisory, VDB Entry
gzip-zgrep-file-installation(20539)

Source: XF
Type: UNKNOWN
gzip-zgrep-bzgrep-code-execution(20539)

Source: OVAL
Type: Third Party Advisory
oval:org.mitre.oval:def:1081

Source: OVAL
Type: Third Party Advisory
oval:org.mitre.oval:def:1107

Source: OVAL
Type: Third Party Advisory
oval:org.mitre.oval:def:9797

Vulnerable Configuration:Configuration 1:
  • cpe:/a:gnu:gzip:*:*:*:*:*:*:*:* (Version < 1.3.5)

    • Configuration 2:
  • cpe:/o:canonical:ubuntu_linux:4.10:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu_linux:5.04:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:gnu:gzip:*:*:*:*:*:*:*:*
  • AND
  • cpe:/a:openpkg:openpkg:current:*:*:*:*:*:*:*
  • OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.3.9:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.3.9:*:*:*:*:*:*:*
  • OR cpe:/a:mandrakesoft:mandrake_multi_network_firewall:2.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2006:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2006::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:home:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.10:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.10:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0::amd64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1::x86_64:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:9797
    V
    		zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.
    2013-04-29
    oval:com.redhat.rhsa:def:20050474
    P
    		RHSA-2005:474: bzip2 security update (Low)
    2008-03-20
    oval:org.mitre.oval:def:1081
    V
    		gzip Argument Sanitation Vulnerability
    2005-09-21
    oval:org.mitre.oval:def:1107
    V
    		gzip zgrep Sanitation Vulnerability
    2005-08-18
    oval:com.redhat.rhsa:def:20050357
    P
    		RHSA-2005:357: gzip security update (Low)
    2005-06-13
    BACK
    gnu gzip *
    canonical ubuntu linux 4.10
    canonical ubuntu linux 5.04
    gnu gzip *
    openpkg openpkg current
    gentoo linux *
    mandrakesoft mandrake linux corporate server 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    mandrakesoft mandrake linux 10.0
    redhat enterprise linux 3
    mandrakesoft mandrake linux 10.1
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    apple mac os x 10.3.9
    apple mac os x server 10.3.9
    mandrakesoft mandrake multi network firewall 2.0
    redhat linux advanced workstation 2.1
    mandrakesoft mandrake linux 2006
    mandrakesoft mandrake linux 10.1
    mandrakesoft mandrake linux 2006
    mandrakesoft mandrake linux corporate server 3.0
    turbolinux turbolinux home *
    apple mac os x 10.4.10
    apple mac os x server 10.4.10
    mandrakesoft mandrake linux 10.0
    mandrakesoft mandrake linux corporate server 2.1