[NEWS] zlib Buffer Overflow Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 07/11/05

  • Next message: SecuriTeam: "[UNIX] GNATS Authentication Bypass Vulnerability" 
    To: list@securiteam.com
Date: 11 Jul 2005 13:05:00 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      zlib Buffer Overflow Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.zlib.net/> zlib is a compression and decompression library
    using the gzip format.

    By creating a specially crafted compressed data stream, attackers can
    overwrite data structures for application that uses zlib. The result may
    cause the application to perform a denial of service by crashing, and may
    also allow attackers to execute arbitrary code.

    DETAILS

    Vulnerable Systems:
     * zlib version 1.2.1
     * zlib version 1.2.2

    In order to exploit the vulnerability, attackers would have to create a
    special crafted compressed streamed data, that will trigger the buffer
    overflow with the inflate_table() function.
    Vulnerable Code:
    inftrees.c:

    if (left > 0 && (type == CODES || (codes - count[0] != 1)))
      return -1; /* incomplete set */

    Workaround:
    You may apply an unofficial patch made by FreeBSD:

    Index: lib/libz/inftrees.c
    -=================================================================
    RCS file: /home/ncvs/src/lib/libz/inftrees.c,v
    retrieving revision 1.5
    diff -u -p -r1.5 inftrees.c
    --- lib/libz/inftrees.c 11 May 2005 03:47:48 -0000 1.5
    +++ lib/libz/inftrees.c 2 Jul 2005 19:29:56 -0000
    @@ -134,7 +134,7 @@ unsigned short FAR *work;
             left -= count[len];
             if (left < 0) return -1; /* over-subscribed */
         }
    - if (left > 0 && (type == CODES || (codes - count[0] != 1)))
    + if (left > 0 && (type == CODES || max != 1))
             return -1; /* incomplete set */
     
         /* generate offsets into symbol table for each length for sorting */

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2096>
    CAN-2005-2096

    ADDITIONAL INFORMATION

    The information has been provided by: Secunia
    <http://secunia.com/advisories/15949/>
    http://secunia.com/advisories/15949/ ,
    FreeBSD Security
    <http://www.niscc.gov.uk/niscc/docs/br-20050707-00552.html?lang=en>
    http://www.niscc.gov.uk/niscc/docs/br-20050707-00552.html?lang=en ,
    c-enter <http://www.c-enter.hu/center/0250564.html>
    http://www.c-enter.hu/center/0250564.html,
    Whitedust <http://www.whitedust.net/speaks/837/>
    http://www.whitedust.net/speaks/837/

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] GNATS Authentication Bypass Vulnerability"

    Relevant Pages

    • [NT] WinPcap NPF.SYS Local Privilege Escalation Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of an input validation vulnerability within the NPF.SYS ... Exploitation allows attackers to execute arbitrary code in kernel context. ... The vulnerable device driver is loaded when WinPcap is initialized. ...
      (Securiteam)
    • [NT] Qualcomm WorldMail IMAP Server Directory Traversal
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Exploitation of a directory transversal vulnerability in Qualcomm ... WorldMail IMAP Server allows attackers to read any email stored on the ...
      (Securiteam)
    • [NT] Microsoft Excel FORMAT Record Invalid Array Index Vulnerability (MS08-044)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Excel FORMAT Record Invalid Array Index Vulnerability ... vulnerability in Microsoft Corp.'s Excel could allows attackers to execute ...
      (Securiteam)
    • [NT] Microsoft Excel Malformed Object Memoy Corruption Vulnerability (MS08-074)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Excel Malformed Object Memoy Corruption Vulnerability ... Excel is the spreadsheet application included with Microsoft Corp.'s ... This allows attackers to exploit ...
      (Securiteam)
    • [NT] OpenView Client Configuration Manager Device Code Execution
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... This vulnerability allows remote attackers to execute arbitrary code on ... Authentication is not required to exploit this vulnerability. ... Where 'port' specifies a connect back port on the connecting client. ...
      (Securiteam)