CVE-2005-1228: Medium severity GNU gzip vulnerability
Published Apr 22, 2005
·Updated
Directory traversal vulnerability in gunzip -N in gzip 1.2.4 through 1.3.5 allows remote attackers to write to arbitrary directories via a .. (dot dot) in the original filename within a compressed file.
Affected Software
2 affected components
GNU gzip=1.3.3
GNU gzip=1.2.4
Remediation
Patch Available
Event History
Apr 22, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-1228?
CVE-2005-1228 is classified as a moderate severity vulnerability due to its potential for directory traversal attacks.
2
How do I fix CVE-2005-1228?
To fix CVE-2005-1228, upgrade your GNU gzip to version 1.3.6 or later where the vulnerability is patched.
3
Which versions of gzip are affected by CVE-2005-1228?
CVE-2005-1228 affects gzip versions 1.2.4 through 1.3.5, including 1.3.3.
4
What type of attack does CVE-2005-1228 enable?
CVE-2005-1228 enables a directory traversal attack allowing remote attackers to write to arbitrary directories.
5
Is CVE-2005-1228 exploitable remotely?
Yes, CVE-2005-1228 is exploitable remotely when an attacker can deliver a specially crafted compressed file.