pxz up to 4.999.98 Access Restriction race condition

Summaryinfo

A vulnerability was found in pxz up to 4.999.98 and classified as problematic. Affected by this issue is some unknown functionality of the component Access Restriction. Executing a manipulation can lead to race condition. This vulnerability is handled as CVE-2015-1200. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in pxz up to 4.999.98. This vulnerability affects an unknown code of the component Access Restriction. The manipulation with an unknown input leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. As an impact it is known to affect integrity. CVE summarizes:

Race condition in pxz 4.999.99 Beta 3 uses weak file permissions for the output file when compressing a file before changing the permission to match the original file, which allows local users to bypass the intended access restrictions.

The weakness was released 01/23/2015 by Alexander Cherepanov (Website). The advisory is shared for download at xforce.iss.net. This vulnerability was named CVE-2015-1200 since 01/18/2015. The exploitation appears to be easy. The attack needs to be approached locally. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 4.999.99 eliminates this vulnerability.

The vulnerability is also documented in the databases at X-Force (100207) and SecurityFocus (BID 72101†). Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• pxz

Version

• 4.999.0
• 4.999.1
• 4.999.2
• 4.999.3
• 4.999.4
• 4.999.5
• 4.999.6
• 4.999.7
• 4.999.8
• 4.999.9
• 4.999.10
• 4.999.11
• 4.999.12
• 4.999.13
• 4.999.14
• 4.999.15
• 4.999.16
• 4.999.17
• 4.999.18
• 4.999.19
• 4.999.20
• 4.999.21
• 4.999.22
• 4.999.23
• 4.999.24
• 4.999.25
• 4.999.26
• 4.999.27
• 4.999.28
• 4.999.29
• 4.999.30
• 4.999.31
• 4.999.32
• 4.999.33
• 4.999.34
• 4.999.35
• 4.999.36
• 4.999.37
• 4.999.38
• 4.999.39
• 4.999.40
• 4.999.41
• 4.999.42
• 4.999.43
• 4.999.44
• 4.999.45
• 4.999.46
• 4.999.47
• 4.999.48
• 4.999.49
• 4.999.50
• 4.999.51
• 4.999.52
• 4.999.53
• 4.999.54
• 4.999.55
• 4.999.56
• 4.999.57
• 4.999.58
• 4.999.59
• 4.999.60
• 4.999.61
• 4.999.62
• 4.999.63
• 4.999.64
• 4.999.65
• 4.999.66
• 4.999.67
• 4.999.68
• 4.999.69
• 4.999.70
• 4.999.71
• 4.999.72
• 4.999.73
• 4.999.74
• 4.999.75
• 4.999.76
• 4.999.77
• 4.999.78
• 4.999.79
• 4.999.80
• 4.999.81
• 4.999.82
• 4.999.83
• 4.999.84
• 4.999.85
• 4.999.86
• 4.999.87
• 4.999.88
• 4.999.89
• 4.999.90
• 4.999.91
• 4.999.92
• 4.999.93
• 4.999.94
• 4.999.95
• 4.999.96
• 4.999.97
• 4.999.98

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion