Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed, whose permissions are changed by bzip2 after the decompression is complete.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
BZip2 TOCTOUd文件权限漏洞
Vulnerability Description
bzip2是一款文件压缩工具，支持Unix和Windows平台。 如果恶意的本地用户可以写访问目录，而目标用户在该目录中使用bzip2压缩或解压文件的话，则攻击者就可以利用TOCTOU漏洞，更改任何属于目标用户文件的权限。在解压时bzip2将压缩bzip2文件的权限拷贝到解压的文件。但是，在写入解压的文件和更改文件权限之间有个时间差，恶意用户可以利用这个时间差删除解压的文件，并用用户其他文件的硬链接替换它，这样bzip2就可以将硬链接文件的权限改为与bzip2文件相同的权限。
CVSS Information
N/A
Vulnerability Type
N/A