[Lugge] Falla in zlib [Fwd: security problem fixed in zlib 1.1.4 [jloup@gzip.org]]

  • From: "Zingus J . Rinkle" <1999s039@xxxxxxxxxxxxxxxxxx>
  • To: lugge@xxxxxxxxxxxxx
  • Date: Wed, 13 Mar 2002 17:17:50 +0100

La notizia e' semplice e veloce. Zlib e' vulnerabile.

La cosa e' grossa: la usano il kernel, ssh ed una riga di altri componenti
dei sistemi linux.

Va aggiornata. I programmi che la compilano staticamente ricompilati
(kernel compreso, direi).

La versione veloce (e poco tecnica) della notizia la da' "punto".
http://www.punto-informatico.it/p.asp?i=39394

Mi pare di aver anche letto che una qualche versione di Debian e' immune,
ma adesso non saprei dirvi quale.

Il problema di una notizia del genere e' che puo' essere interpretata male
e/o usata maliziosamente, il tutto a danno dell'OpenSource.

Segue forward da Bugtraq dell'autore di zlib,
Zingus

PS: In Bugtraq ho pure gia' visto degli exploit per openssh...

On 2002.03.11 22:00 Jean-loup Gailly wrote:

Zlib Advisory 2002-03-11
zlib Compression Library Corrupts malloc Data Structures via Double Free

   Original release date: March 11, 2002
   Last revised: March 11, 2002
   Source: This advisory is based on a CERT advisory written 
           by Jeffrey P. Lanza. See original on http://www.cert.org

Systems Affected

     * Any software that is linked against zlib 1.1.3 or earlier
     * Any data compression library derived from zlib 1.1.3 or earlier

Overview

   There is a vulnerability in the zlib shared library that may introduce
   vulnerabilities   into   any   program   that   includes   zlib.  This
   vulnerability has been assigned a CVE candidate name of CAN-2002-0059
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0059

I. Description

   There  is  a  vulnerability in the decompression algorithm used by the
   popular  zlib  compression  library.  If an attacker is able to pass a
   specially-crafted  block of invalid compressed data to a program  that
   includes zlib,  the program's  attempt to decompress  the crafted data
   can cause the  zlib  routines to corrupt the internal data  structures
   maintained by malloc.

   The  vulnerability  results  from  a  programming  error  that  causes
   segments of dynamically allocated memory to be released more than once
   (aka.   "double-freed").  Specifically,  when  inftrees.c:huft_build()
   encounters  the  crafted data, it returns an unexpected Z_MEM_ERROR to
   inftrees.c:inflate_trees_dynamic().  When a subsequent call is made to
   infblock.c:inflate_blocks(), the inflate_blocks function tries to free
   an internal data structure a second time.

   Because  this  vulnerability interferes with the proper allocation and
   de-allocation  of dynamic memory, it may be possible for an attacker to
   influence  the  operation  of  programs  that  include  zlib.  In most
   circumstances,  this influence will be limited to denial of service or
   information  leakage, but it is theoretically possible for an attacker
   to  insert  arbitrary  code into a running program. This code would be
   executed with the permissions of the vulnerable program.

II. Impact

   This vulnerability may introduce vulnerabilities into any program that
   includes  the  affected library. Depending upon how and where the zlib
   routines   are   called   from   the   given  program,  the  resulting
   vulnerability may have one or more of the following impacts: denial of
   service, information leakage, or execution of arbitrary code.

III. Solution

Upgrade your version of zlib

   The  maintainers  of  zlib have released version 1.1.4 to address this
   vulnerability.  Any software that is linked against or derived from an
   earlier  version  of  zlib  should be upgraded immediately. The latest
   version of zlib is available at http://www.zlib.org

   The md5 sums of the source archives are:
       abc405d0bdd3ee22782d7aa20e440f08  zlib-1.1.4.tar.gz
       ea16358be41384870acbdc372f9db152  zlib-1.1.4.tar.bz2

IV. Acknowledgments

Thanks to Owen Taylor and other people at Redhat Inc. for the
reporting and research of this vulnerability.

This document is available from
http://www.gzip.org/zlib/advisory-2002-03-11.txt

The public PGP key of zlib author Jean-loup Gailly is available from
http://www.gzip.org/zlib/jloup.asc

-- 
__________   __________ +--------------------------------------------+
\____     \ /     ____/ | ZJR stands for Zingus J. Rinkle            |
 \___     ZJR     ___/  | (what the J. stands for, no one can tell)  |
  \_______/ \_______/   | zingusrinkle at iname.com                  |
http://www.as1.da.ru    +--------------------------------------------+
-- Get Flashed: ------------------------------------------------------
        while test -true ; do  xrefresh -black; done 
<========----------
 Prima di scrivere in m-list per favore leggi il regolamento
 http://lugge.ziobudda.net/soci/manifesto.htm#list

----------========>
 Corso Linux Base: martedì 15:00-18:00
 Incontro in sede: sabato   9:30-12.30


Other related posts:

  • » [Lugge] Falla in zlib [Fwd: security problem fixed in zlib 1.1.4 [jloup@gzip.org]]