Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

For bugs related to Red Hat Enterprise Linux 2.1 product line. For Red Hat Enterprise Linux 6 and above, please visit Red Hat JIRA https://issues.redhat.com/secure/CreateIssue!default.jspa?pid=12332745 to report new issues.

Bug 136661

Summary:	CAN-2001-1413 Stack-based buffer overflow in the comprexx function
Product:	Red Hat Enterprise Linux 2.1	Reporter:	Josh Bressers <bressers>
Component:	ncompress	Assignee:	Peter Vrabec <pvrabec>
Status:	CLOSED ERRATA	QA Contact:	Ben Levenson <benl>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	2.1	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=moderate,public=20011120
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2004-12-13 19:31:30 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2004-10-21 15:15:48 UTC

A stack-based buffer overflow in the comprexx function for ncompress
4.2.4 and earlier exists.

When used in situations that cross security boundaries (such as FTP
server), may allow remote attackers to execute arbitrary code via a
long filename argument.

This will be fixed in U6 as RHSA-2004:536

Comment 1 John Flanagan 2004-12-13 19:31:30 UTC

An errata has been issued which should help the problem 
described in this bug report. This report is therefore being 
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, 
please follow the link below. You may reopen this bug report 
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2004-536.html