Ubuntu 11.10: 1308-1 Critical Advisory on bzip2 Local Attack Execution

ubuntu

December 14, 2011

Executables compressed by bzexe could be made to run programs as yourlogin.

Summary

Executables compressed by bzexe could be made to run programs as your

Software Description:

- bzip2: high-quality block-sorting file compressor - utilities

Details:

vladz discovered that executables compressed by bzexe insecurely create

temporary files when they are ran. A local attacker could exploit this issue to

execute arbitrary code as the user running a compressed executable.

Topics Covered

security advisory critical local execution temporary files ubuntu bzip2

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  bzip2                           1.0.5-6ubuntu1.11.10.1

Ubuntu 11.04:
  bzip2                           1.0.5-6ubuntu1.11.04.1

Ubuntu 10.10:
  bzip2                           1.0.5-4ubuntu1.1

Ubuntu 10.04 LTS:
  bzip2                           1.0.5-4ubuntu0.2

Ubuntu 8.04 LTS:
  bzip2                           1.0.4-2ubuntu4.2

In general, a standard system update will make all the necessary changes to
the bzexe utility. If you have previously used bzexe to compress any
executables, they need to be recompressed using the updated version.