Software Engineering Institute

The gzip program is used to compress and decompress archived files. Some implementations of gzip include support for the LZH compression algorithm.

A buffer overflow vulnerability exists in the way gzip handles certain files compressed with the LZH algorithm. An attacker may be able to exploit this vulnerability by convincing a user to open a specially crafted gzip file.

Note that the attacker could either 1) convince a user to open a malicious gzip file, or 2) save the file in a place where another program would call gzip to decompress the archive.

A remote, unauthenticated attacker may be able to execute arbitrary code or create a denial-of-service condition.

Upgrade or apply a patch from the vendor
This issue has been addressed in gzip 1.3.6. See the systems affected section of this document for information about specific vendors.

Workarounds
Until updates can be applied, the following workarounds may mitigate the impact of this vulnerability:

• Do not decompress gzip files that are received from unknown sources.
• Do not execute gzip with system-level privileges.
• Some automated processes may rely on gzip to complete their tasks. When possible, disable such programs or do not allow them to execute gzip with root privileges.