CVE-2013-0296: Race Condition
Published Feb 15, 2013
·Updated
Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring.
Affected Software
3 affected componentsFixes available
debian/pigz<=2.2.4-1, <=2.1.6-1
2.2.4-22.1.6-1+squeeze1
debian/pigz
2.6-12.8-1
zlib Pigz<=2.2.4-1
Event History
Apr 27, 2014
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
via NVD·09:55 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2013-0296?
CVE-2013-0296 is considered a medium severity vulnerability due to the risk of local users bypassing access permissions.
2
How do I fix CVE-2013-0296?
To fix CVE-2013-0296, upgrade pigz to version 2.2.5 or later.
3
Which versions of pigz are affected by CVE-2013-0296?
CVE-2013-0296 affects pigz versions prior to 2.2.5, including 2.2.4-2 and 2.1.6-1+squeeze1.
4
Can CVE-2013-0296 be exploited by remote attackers?
CVE-2013-0296 cannot be exploited by remote attackers; it can only be exploited by local users.
5
What type of vulnerability is CVE-2013-0296?
CVE-2013-0296 is a race condition vulnerability that affects file permission settings during compression.