CERT/CC Vulnerability Note VU#680620

Overview

A buffer overflow in the zlib compression library may cause any application linked to zlib to improperly and immediately terminate.

Description

There is a buffer overflow in the zlib data-compression library caused by a lack of bounds checking in the inflate() routine. If an attacker supplies the inflate()routine with a specially crafted compressed data stream, that attacker may be able to trigger the buffer overflow causing any application linked to zlib, or incorporating zlib code to crash. According to reports, the buffer overflow is caused by a specific input stream and results in a constant value being written into an arbitrary memory location. This vulnerability may be exploited locally or remotely depending on the application being attacked.

This vulnerability only affects zlib versions 1.2.1 and 1.2.2.

Impact

A remote attacker be able to exploit this vulnerability by supplying the inflate() routine with specially crafted compressed data. As a result, applications linked to the zlib library may abruptly and abnormally terminate resulting in a denial-of-service condition. According to public reports, this vulnerability can be exploited to execute arbitrary code, but we have not confirmed this.

Solution

Apply patches from your vendor

The zlib compression library is freely available and used by many vendors in a wide variety of applications. As a result, any one of these applications may contain this vulnerabilitiy. Users are encouraged to contact their vendors to determine if they are vulnerable and what action to take.

Vendor Information

680620

Filter by status:

Filter by content: Additional information available

Sort by:

Expand all

CVS Home Affected

Gentoo Affected

Mandriva, Inc. Affected

Red Hat, Inc. Affected

Foundry Networks Inc. Not Affected

Juniper Networks, Inc. Not Affected

Microsoft Corporation Not Affected

NetBSD Not Affected

Notified: July 11, 2005 Updated: July 11, 2005

Status

Not Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 NetBSD Security Note 20050708-1 =============================== Topic:NetBSD base system not vulnerable to zlib overflow pkgsrc did provide vulnerable versions A zlib buffer overflow has been announced. http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2005-2096 The NetBSD Security Officer team was aware of this issue, and would like to reassure users that the NetBSD base system is not vulnerable. The bug was introduced in changes to zlib after 1.1.4, the latest version supplied in the base install of NetBSD. The vulnerable version, 1.2.2 has been available from pkgsrc. Users of the audit-packages tool will already have noticed that version is marked as vulnerable, and the 1.2.2nb1 update addresses the issue. Other pkgsrc users are encouraged to update devel/zlib to 1.2.2nb1, as well as to take advantage of the security/audit-packages infrastructure. Thanks To ========= Tavis Ormandy Colin Percival Mark Adler Matthias Drochner Matthias Scheler More Information ================ Information about NetBSD and NetBSD security can be found at http://www.NetBSD.org/ and http://www.NetBSD.org/Security/. Copyright 2005, The NetBSD Foundation, Inc. All Rights Reserved. Redistribution permitted only in full, unmodified form. $N e t B S D : N e t B S D - S N 20050708 - 1. t x t, v 1.1 2005 / 07 / 0815 : 54 : 11 d a v i d E x p$ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (NetBSD) iQCVAwUBQs6+TD5Ru2/4N2IFAQI9HAQAvT7R6nDbr+xDroAXYkZrs2zdI9gkIStc UswbbKNP1G8D90h4nIKrXtvNyG+e4squRtawLB06Fylu+OkielUWeTPIzzwmef0V qWqWBxg1EWM2WigyDS/SmA6lrQt+dgJ4bfX0IiwakBItdM6v5yScB9svI4qi0aNl n8+PU7IvbGU= =PWU8 -----END PGP SIGNATURE-----

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Openwall GNU/*/Linux Not Affected

TurboLinux Not Affected

Notified: July 11, 2005 Updated: July 12, 2005

Status

Not Affected

Vendor Statement

Please refer to the following URL:

English

http://www.turbolinux.com/security/2005/TLSA-2005-77.txt

Japanese

http://www.turbolinux.co.jp/security/2005/TLSA-2005-77j.txt

Other products are "Not Vulnerable".

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

--------------------------------------------------------------------------
Turbolinux Security Advisory TLSA-2005-77
http://www.turbolinux.co.jp/security/
security-team@turbolinux.co.jp
--------------------------------------------------------------------------

Original released date: 11 Jul 2005
Last revised: 11 Jul 2005

Package: zlib

Summary: Buffer overflow

More information:
Zlib is a widely used compression and decompression library.
A buffer overflow vulnerability exists in zlib.

Impact:
The zlib allows attackers to cause a denial of service via a crafted file.

Affected Products:
- Turbolinux 10 Server

Solution:
Please use the turbopkg (zabom) tool to apply the update.
---------------------------------------------
# turbopkg
or
# zabom -u zlib zlib-devel
---------------------------------------------

<Turbolinux 10 Server>

Source Packages
Size: MD5

ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/SRPMS/zlib-1.2.1-4.src.rpm
293562 ccc7c91245fd4915b9c437df5d8507b2

Binary Packages
Size: MD5

ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/zlib-1.2.1-4.i586.rpm
65883 db85def8bf7e2c4056bcaae7335f03ab
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/zlib-debug-1.2.1-4.i586.rpm
125754 6588b66e89375b9ec9df6c1753628c42
ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/updates/RPMS/zlib-devel-1.2.1-4.i586.rpm
61584 4884c0ca20644d34ddb339549187dedb

References:

CVE
[CAN-2005-2096]
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2096

--------------------------------------------------------------------------
Revision History
11 Jul 2005 Initial release
--------------------------------------------------------------------------

Copyright(C) 2005 Turbolinux, Inc. All rights reserved.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFC0hzrK0LzjOqIJMwRAl71AJ9NoBH54Un8KGxnmYI1+y5iXwE+hwCdFUm+
IukMopqTxoX+N6V7G+pBevM=
=PPTv
-----END PGP SIGNATURE-----

If you have feedback, comments, or additional information about this vulnerability, please send us email.

3Com Unknown

AT&T Unknown

Alcatel Unknown

Apple Computer, Inc. Unknown

Avaya Unknown

Avici Systems Inc. Unknown

Borderware Unknown

Check Point Unknown

Chiaro Networks Unknown

Cisco Systems, Inc. Unknown

Clavister Unknown

Computer Associates Unknown

Cray Inc. Unknown

Cwnt Unknown

Data Connection Unknown

Debian Linux Unknown

EMC Corporation Unknown

Engarde Unknown

Extreme Networks Unknown

F5 Networks, Inc. Unknown

Force10 Networks Inc. Unknown

Fortinet Unknown

FreeBSD, Inc. Unknown

Notified: July 11, 2005 Updated: July 11, 2005

Status

Unknown

Vendor Statement

FreeBSD 5.3 and FreeBSD 5.4 are affected by this issue. It was addressed in the security advisory FreeBSD-SA-05:16.zlib, which provides instructions on how to correct the problem.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ============================================================================= FreeBSD-SA-05:16.zlib Security Advisory The FreeBSD Project Topic: Buffer overflow in zlib Category: core Module: libz Announced: 2005-07-06 Credits: Tavis Ormandy Affects: FreeBSD 5.3, FreeBSD 5.4 Corrected: 2005-07-06 14:01:11 UTC (RELENG_5, 5.4-STABLE) 2005-07-06 14:01:30 UTC (RELENG_5_4, 5.4-RELEASE-p4) 2005-07-06 14:01:52 UTC (RELENG_5_3, 5.3-RELEASE-p18) CVE Name: CAN-2005-2096 For general information regarding FreeBSD Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit <URL:http://www.freebsd.org/security/>. I. Background zlib is a compression library used by numerous applications to provide data compression/decompression routines. II. Problem Description An error in the handling of corrupt compressed data streams can result in a buffer being overflowed. III. Impact By carefully crafting a corrupt compressed data stream, an attacker can overwrite data structures in a zlib-using application. This may cause the application to halt, causing a denial of service; or it may result in the attacker gaining elevated privileges. IV. Workaround No workaround is available. V. Solution Perform one of the following: 1) Upgrade your vulnerable system to 5-STABLE, or to the RELENG_5_4 or RELENG_5_3 security branch dated after the correction date. 2) To patch your present system: The following patch has been verified to apply to FreeBSD 5.3 and 5.4 systems. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:16/zlib.patch # fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:16/zlib.patch.asc b) Execute the following commands as root: # cd /usr/src # patch < /path/to/patch # cd /usr/src/lib/libz/ # make obj && make depend && make && make install VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch Revision Path - ------------------------------------------------------------------------- RELENG_5 src/lib/libz/inftrees.c 1.4.2.2 RELENG_5_4 src/UPDATING 1.342.2.24.2.13 src/sys/conf/newvers.sh 1.62.2.18.2.9 src/lib/libz/inftrees.c 1.4.6.1 RELENG_5_3 src/UPDATING 1.342.2.13.2.21 src/sys/conf/newvers.sh 1.62.2.15.2.23 src/lib/libz/inftrees.c 1.4.4.1 - ------------------------------------------------------------------------- VII. References http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2096 The latest revision of this advisory is available at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:16.zlib.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (FreeBSD) iD8DBQFCy+TYFdaIBMps37IRAqB2AJ4j+wdqj1zJJZdTjskufo7rrsHhcwCgi0SZ wXRUgGbgl/DtNzyvHi7t/bc= =anun -----END PGP SIGNATURE-----

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Fujitsu Unknown

GTA Unknown

Hewlett-Packard Company Unknown

Hitachi Unknown

Hyperchip Unknown

IBM Corporation Unknown

IBM eServer Unknown

IBM-zSeries Unknown

IPf Unknown

ISS Unknown

Immunix Unknown

Ingrian Networks, Inc. Unknown

Inoto Unknown

Intel Unknown

Linksys Unknown

Lucent Technologies Unknown

Luminous Unknown

Mandriva, Inc. Unknown

MontaVista Software, Inc. Unknown

Multi-Tech Systems Inc. Unknown

Multinet Unknown

NEC Corporation Unknown

Netfilter Unknown

Network Appliance Unknown

NextHop Unknown

Nortel Networks, Inc. Unknown

Novell, Inc. Unknown

OpenBSD Unknown

QNX Unknown

Redback Networks Inc. Unknown

Riverstone Networks Unknown

SGI Unknown

SUSE Linux Unknown

Secure Computing Corporation Unknown

SecureWorks Unknown

Sequent Computer Systems, Inc. Unknown

Sony Corporation Unknown

Stonesoft Unknown

Sun Microsystems, Inc. Unknown

Symantec Corporation Unknown

The SCO Group (SCO Linux) Unknown

The SCO Group (SCO Unix) Unknown

Unisys Unknown

WatchGuard Unknown

Wind River Systems, Inc. Unknown

Zlib.org Unknown

ZyXEL Unknown

eSoft Unknown

View all 82 vendors View less vendors

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

Acknowledgements

This vulnerability was reported by Mark Adler.

This document was written by Jeff Gennari.

Other Information

CVE IDs:	CVE-2005-2096
Severity Metric:	9.45
Date Public:	2005-07-02
Date First Published:	2005-07-07
Date Last Updated:	2007-04-05 12:45 UTC
Document Revision:	83

Software Engineering Institute

CERT Coordination Center

zlib inflate() routine vulnerable to buffer overflow

Vulnerability Note VU#680620

Overview

Description

Impact

Solution

Vendor Information

CVS Home Affected

Gentoo Affected

Mandriva, Inc. Affected

Red Hat, Inc. Affected

Foundry Networks Inc. Not Affected

Juniper Networks, Inc. Not Affected

Microsoft Corporation Not Affected

NetBSD Not Affected

Openwall GNU/*/Linux Not Affected

TurboLinux Not Affected

3Com Unknown

AT&T Unknown

Alcatel Unknown

Apple Computer, Inc. Unknown

Avaya Unknown

Avici Systems Inc. Unknown

Borderware Unknown

Check Point Unknown

Chiaro Networks Unknown

Cisco Systems, Inc. Unknown

Cisco Systems, Inc. Unknown

Clavister Unknown

Computer Associates Unknown

Cray Inc. Unknown

Cwnt Unknown

Data Connection Unknown

Debian Linux Unknown

EMC Corporation Unknown

Engarde Unknown