[MBT] new ticket for pkg bzip2 "Possible file overwriting bug"

[bugs at pld.org.pl]

Date: 2003-02-28 16:45:20+01	Author:  (kreutzm) <kreutzm at itp.uni-hannover.de> 
Title:         Possible file overwriting bug
Ticket ID:     #588
Ticket URL:    http://bugs.pld.org.pl/?bug=588
Package:       bzip2-1.0.2-2
Distribution:  PLD-Ra.main
Category:      security problem
Current state: opened
Text:

bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, and other operating systems, does not use the O_EXCL flag to create files during decompression and does not warn the user if an existing file would be overwritten, which could allow attackers to overwrite files via a bzip2 archive. 

CAN-2002-0759

According to 

http://www.iss.net/security_center/static/9126.php

this affects also Linux systems. This is supposedly fixed in 1.0.2 (which is the PLD version) but reading the NEWS.gz file there is no mention of it, neither on the bzip2 homepage. It would be great thus if you could check it (I hread the *BSD like to include patches and forget to hand it upstream)

Thanks.