CVE-2002-0759
bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, does not use the O_EXCL flag to create files during decompression and does not warn the user if an existing file would be overwritten, which could allow attackers to overwrite files via a bzip2 archive.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What versions of bzip2 are affected by CVE-2002-0759?
CVE-2002-0759 affects bzip2 versions prior to 1.0.2, specifically 0.9.0 through 1.0.1.
What is the main issue with CVE-2002-0759?
CVE-2002-0759 allows attackers to overwrite files during decompression without warning, due to the absence of the O_EXCL flag.
How can I protect my system from CVE-2002-0759?
To protect against CVE-2002-0759, update bzip2 to version 1.0.2 or later.
What platforms are impacted by CVE-2002-0759?
CVE-2002-0759 affects FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, among possibly others.
Is there a workaround for CVE-2002-0759 if I cannot upgrade?
A workaround for CVE-2002-0759 is to manually verify file names before running the decompression to avoid unintentional overwriting.