bugtraq - [ MDKSA-2006:167 ] - Updated gzip packages fix multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1GQCKH-0001SP-1L@mercury.mandriva.com>
Date: Wed, 20 Sep 2006 18:22:00 -0600
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDKSA-2006:167 ] - Updated gzip packages fix multiple vulnerabilities


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2006:167
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : gzip
 Date    : September 20, 2006
 Affected: 2006.0, Corporate 3.0, Corporate 4.0,
           Multi Network Firewall 2.0
 _______________________________________________________________________
 
 Problem Description:
 
 NULL Dereference (CVE-2006-4334)

 A stack modification vulnerability (where a stack buffer can be
 modified out of bounds, but not in the traditional stack overrun sense)
 exists in the LZH decompression support of gzip. (CVE-2006-4335)

 A .bss buffer underflow exists in gzip's pack support, where a loop
 from build_tree() does not enforce any lower bound while constructing
 the prefix table. (CVE-2006-4336)

 A .bss buffer overflow vulnerability exists in gzip's LZH support, due
 to it's inability to handle exceptional input in the make_table()
 function, a pathological decoding table can be constructed in such a
 way as to generate counts so high that the rapid growth of `nextcode`
 exceeds the size of the table[] buffer. (CVE-2006-4337)

 A possible infinite loop exists in code from unlzh.c for traversing the
 branches of a tree structure. This makes it possible to disrupt the
 operation of automated systems relying on gzip for data decompression,
 resulting in a minor DoS. (CVE-2006-4338)  Updated packages have been
 patched to address these issues.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4334
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4335
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4336
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4337
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4338
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2006.0:
 6da645cd7adea1af99a3fcd11e5a3fbc  2006.0/i586/gzip-1.2.4a-15.3.20060mdk.i586.rpm 
 d4acb45be5d2683759578a37d1b8435f  2006.0/SRPMS/gzip-1.2.4a-15.3.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 732d50ab4b4d7e18751f8a24026182d2  2006.0/x86_64/gzip-1.2.4a-15.3.20060mdk.x86_64.rpm 
 d4acb45be5d2683759578a37d1b8435f  2006.0/SRPMS/gzip-1.2.4a-15.3.20060mdk.src.rpm

 Corporate 3.0:
 6d80bed89cf647be72f127ed17c5359c  corporate/3.0/i586/gzip-1.2.4a-13.5.C30mdk.i586.rpm 
 6c4e3de8975f5f568c5a7a18e7946112  corporate/3.0/SRPMS/gzip-1.2.4a-13.5.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 7ed6fcfcaa6a43d5e6d055f72a7f7bc5  corporate/3.0/x86_64/gzip-1.2.4a-13.5.C30mdk.x86_64.rpm 
 6c4e3de8975f5f568c5a7a18e7946112  corporate/3.0/SRPMS/gzip-1.2.4a-13.5.C30mdk.src.rpm

 Corporate 4.0:
 da60be3f5d293fa5c246edf6ae256420  corporate/4.0/i586/gzip-1.2.4a-15.3.20060mlcs4.i586.rpm 
 71ee80833c3dd784d1a604698376b0a4  corporate/4.0/SRPMS/gzip-1.2.4a-15.3.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 940923c3880d84e597a8507155cc81fd  corporate/4.0/x86_64/gzip-1.2.4a-15.3.20060mlcs4.x86_64.rpm 
 71ee80833c3dd784d1a604698376b0a4  corporate/4.0/SRPMS/gzip-1.2.4a-15.3.20060mlcs4.src.rpm

 Multi Network Firewall 2.0:
 c60c6b5559a4f6f3c9fa811433f2bce6  mnf/2.0/i586/gzip-1.2.4a-13.5.M20mdk.i586.rpm 
 b68cb1643f57f850fef0224788f95795  mnf/2.0/SRPMS/gzip-1.2.4a-13.5.M20mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFFEa5fmqjQ0CJFipgRAsAYAKCe1lgl7sy1o33Xa63FGEMmW6+GPQCdGhUd
XWAk7HaQOXICJUcuFHxyYSE=
=C3be
-----END PGP SIGNATURE-----