CVE-2005-0988 Race condition in n/a

Low 3.7 Published 6 Apr 2005 Updated 7 Aug 2024

Local attackers can exploit a race condition in gzip to modify permissions of arbitrary files via hard link attacks during decompression.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2005-0988?

CVE-2005-0988 is a low-severity vulnerability in Freebsd Freebsd, published on 6 Apr 2005. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a gzipped file, allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by gzip after the decompression is complete.

Which versions are affected by CVE-2005-0988?

It affects 13 products.

Products include Freebsd Freebsd, Gentoo Linux, Gnu Gzip, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Linux Advanced Workstation and 7 more.

How do I fix CVE-2005-0988?

Upgrade to a fixed version.

Is CVE-2005-0988 being exploited?

There is no known exploitation of CVE-2005-0988 in the wild and no public exploit code.

All Freebsd Freebsd vulnerabilities

Sources

Also known as DEBIAN-CVE-2005-0988, GHSA-pmqf-rc4m-6f55.