Advisories
Mandriva Advisories
|
 |
| Problem Description |
A directory traversal vulnerability was discovered in unzip version
5.42 and earlier that allows attackers to overwrite arbitrary files
during extraction of the archive by using a ".." (dot dot) in an
extracted filename, as well as prefixing filenames in the archive with
"/" (slash).
| Updated Packages |
Mandrakelinux 7.1
ab909f58fa8b6cac86bfc95813035579 7.1/RPMS/unzip-5.50-2.1mdk.i586.rpm af61004cadf81c51aee95ceaa0f66d17 7.1/SRPMS/unzip-5.50-2.1mdk.src.rpm
Mandrakelinux 7.2
ab909f58fa8b6cac86bfc95813035579 7.2/RPMS/unzip-5.50-2.1mdk.i586.rpm af61004cadf81c51aee95ceaa0f66d17 7.2/SRPMS/unzip-5.50-2.1mdk.src.rpm
Mandrakelinux 8.0
d70fef1d9a8c1ff7eccff62e283d1992 8.0/RPMS/unzip-5.50-2.1mdk.i586.rpm af61004cadf81c51aee95ceaa0f66d17 8.0/SRPMS/unzip-5.50-2.1mdk.src.rpm
Mandrakelinux 8.0/PPC
5e8d9366e92efd764e8f08f394b0fe60 ppc/8.0/RPMS/unzip-5.50-2.1mdk.ppc.rpm af61004cadf81c51aee95ceaa0f66d17 ppc/8.0/SRPMS/unzip-5.50-2.1mdk.src.rpm
Mandrakelinux 8.1
9c684644594628a09247ada42a566185 8.1/RPMS/unzip-5.50-2.1mdk.i586.rpm af61004cadf81c51aee95ceaa0f66d17 8.1/SRPMS/unzip-5.50-2.1mdk.src.rpm
Mandrakelinux 8.1/IA64
5effdffc706442ddd5ef933b139805bc ia64/8.1/RPMS/unzip-5.50-2.1mdk.ia64.rpm af61004cadf81c51aee95ceaa0f66d17 ia64/8.1/SRPMS/unzip-5.50-2.1mdk.src.rpm
Mandrakelinux 8.2
33bf02cef205d3b4d4e66c49618a67cf 8.2/RPMS/unzip-5.50-2.1mdk.i586.rpm af61004cadf81c51aee95ceaa0f66d17 8.2/SRPMS/unzip-5.50-2.1mdk.src.rpm
Mandrakelinux 8.2/PPC
0f1c77bf8ab5ef1399eb906c98e2b269 ppc/8.2/RPMS/unzip-5.50-2.1mdk.ppc.rpm af61004cadf81c51aee95ceaa0f66d17 ppc/8.2/SRPMS/unzip-5.50-2.1mdk.src.rpm
Corporate Server 1.0.1
ab909f58fa8b6cac86bfc95813035579 1.0.1/RPMS/unzip-5.50-2.1mdk.i586.rpm af61004cadf81c51aee95ceaa0f66d17 1.0.1/SRPMS/unzip-5.50-2.1mdk.src.rpm
| References |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1268
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1269
http://online.securityfocus.com/archive/1/196445
| Upgrade |
To upgrade automatically, use MandrivaUpdate.
| Verification |
Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :
rpm --checksig package.rpm
You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.
If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.