Mandrake alert: Updated unzip packages fix vulnerability
A vulnerability was discovered in unzip 5.50 and earlier that allows attackers to overwrite arbitrary files during archive extraction by placing non-printable characters between two "." characters. These invalid characters are filtered which results in a ".." sequence.
-----BEGIN PGP SIGNED MESSAGE-----
Mandrake Linux Security Update Advisory
Package name: unzip
Advisory ID: MDKSA-2003:073-1
Date: August 19th, 2003
Original Advisory Date: July 7th, 2003
Affected versions: 8.2, 9.0, 9.1, Corporate Server 2.1,
Multi Network Firewall 8.2
A vulnerability was discovered in unzip 5.50 and earlier that allows
attackers to overwrite arbitrary files during archive extraction by
placing non-printable characters between two "." characters. These
invalid characters are filtered which results in a ".." sequence.
The patch applied to these packages prevents unzip from writing to
parent directories unless the "-:" command line option is used.
Ben Laurie found that the original patch used to fix this issue missed
a case where the path component included a quoted slash. An updated
patch was used to build these packages.
Corporate Server 2.1:
Corporate Server 2.1/x86_64:
Mandrake Linux 8.2:
Mandrake Linux 8.2/PPC:
Mandrake Linux 9.0:
Mandrake Linux 9.1:
Mandrake Linux 9.1/PPC:
Multi Network Firewall 8.2:
Bug IDs fixed (see https://qa.mandrakesoft.com for more information):
To upgrade automatically, use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
A list of FTP mirrors can be obtained from:
All packages are signed by MandrakeSoft for security. You can obtain
the GPG public key of the Mandrake Linux Security Team by executing:
gpg --recv-keys --keyserver http://www.mandrakesecure.net 0x22458A98
Please be aware that sometimes it takes the mirrors a few hours to
You can view other update advisories for Mandrake Linux at:
MandrakeSoft has several security-related mailing list services that
anyone can subscribe to. Information on these lists can be obtained by
If you want to report vulnerabilities, please contact
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
-----END PGP SIGNATURE-----
This topic does not have any threads posted yet!
You cannot post until you login.