CVE-2002-0759: Medium severity Bzip bzip2 vulnerability
bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, does not use the OEXCL flag to create files during decompression and does not warn the user if an existing file would be overwritten, which could allow attackers to overwrite files via a bzip2 archive.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What versions of bzip2 are affected by CVE-2002-0759?
CVE-2002-0759 affects bzip2 versions prior to 1.0.2, specifically 0.9.0 through 1.0.1.
What is the main issue with CVE-2002-0759?
CVE-2002-0759 allows attackers to overwrite files during decompression without warning, due to the absence of the O_EXCL flag.
How can I protect my system from CVE-2002-0759?
To protect against CVE-2002-0759, update bzip2 to version 1.0.2 or later.
What platforms are impacted by CVE-2002-0759?
CVE-2002-0759 affects FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, among possibly others.
Is there a workaround for CVE-2002-0759 if I cannot upgrade?
A workaround for CVE-2002-0759 is to manually verify file names before running the decompression to avoid unintentional overwriting.