lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 29 Oct 2007 22:05:02 +0100 From: "Stefan Kanthak" <stefan.kanthak@...go.de> To: <bugtraq@...urityfocus.com> Subject: Windows binary of "Virtual Floppy Drive 2.1" contains vulnerable zlib (CAN-2005-2096) The binary of the (presumably not widely used) Windows software "Virtual Floppy Drive 2.1" <http://chitchat.at.infoseek.co.jp/vmware/vfd.html> ships with a vfd.dll that is statically linked against zlib 1.2.2 <http://www.zlib.net/> which is vulnerable to CAN-2005-2096. A scan with ClamAV against the patterns published by Florian Weimer at <http://www.enyo.de/fw/security/zlib-fingerprint/> verifies the presence of the patterns of the vulnerable code: | x:\>clamscan --database CAN-2005-2096.db | VFD.DLL: CAN-2005-2096.zlib-1.2.2 FOUND | | ----------- SCAN SUMMARY ----------- | Known viruses: 16 | Engine version: 0.91.2 | Scanned directories: 1 | Scanned files: 1 The author and maintainer has been contacted twice via mail in the last four weeks but choose not to respond at all. Stefan Kanthak