bugtraq - Re: Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87A2B49DAFAB4FFEABDC71C060D06762@localhost>
Date: Sun, 21 Oct 2007 14:18:43 +0200
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: <bugtraq@...urityfocus.com>
Subject: Re: Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096)

Anonymous <farion42@...oo.de> wrote Saturday, October 20, 2007 11:55 AM:

> As a workaround, one could try to manually replace zlib32.dll in a Windows
> GSView 4.8 installation with the current zlib1.dll version 1.2.3.
>
> "Applications linking statically with or using their own copy of zlib 1.1.3
> or earlier must be recompiled to avoid the security problem described here.
> Otherwise it is sufficient to upgrade the shared zlib library then restart
> all applications using it."[1]
>
> [1] http://www.zlib.net/apps.html

http://www.zlib.net/DLL_FAQ.txt (according to the HTTP response last
modified on Sunday, 24 Oct 2004 20:53:16 GMT) states that zlib1.dll 1.2.x
is linked against MSVCRT.DLL.

The vulnerable ZLIB32.DLL distributed with GSview 4.8 is but not linked
against MSVCRT.DLL. Although its version/copyright strings equal the ones
of the "official" zlib1.dll from zlib.net, I'm not sure who built the
ZLIB32.DLL in question. It doesn't completely look like the "official"
zlib1.dll.

Unfortunately the maintainer of GSview choose not to reply to my bug
report which included a question about the source of the ZLIB32.DLL.

As long as I cant be sure that the replacement zlib1.dll from zlib.net
is fully compatible to the ZLIB32.DLL distributed with GSview 4.8 I wont
give any advice to exchange it.

BTW: replacement of ZLIB32.DLL wont close all the vulnerabilities in
GSview 4.8. The maintainer was informed about some more (trivial to spot)
vulnerabilities together with the here published one.

Stefan Kanthak

BTW: your "reply" is missing a "References:" (or "In-Reply-To:") header!