Bug 84961 - buffer overrun on gzprintf
buffer overrun on gzprintf
Status: CLOSED ERRATA
Product: Red Hat Linux
Classification: Retired
Component: zlib (Show other bugs)
7.3
All Linux
medium Severity medium
: ---
: ---
Assigned To: Jeff Johnson
Mike McLean
http://www.securityfocus.com/archive/...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2003-02-24 07:45 EST by Arenas Belon, Carlo Marcelo
Modified: 2007-04-18 12:51 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2003-02-24 21:34:45 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
zlib 1.1.4 patch that test for [v]snprintf support and fixes overflow (2.36 KB, patch)
2003-02-24 07:48 EST, Arenas Belon, Carlo Marcelo
no flags Details | Diff

  None (edit)
Description Arenas Belon, Carlo Marcelo 2003-02-24 07:45:08 EST
From Bugzilla Helper:
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; T312461; .NET 
CLR 1.0.3705)

Description of problem:
when the function gzprintf is called with a string bigger than Z_PRINTF_BUFZISE 
it overflows without giving a warning.

it defaults to the unsafe functions unless instructed at compile time to use 
the secure ones that won't overflow, no warning is given of an error on those 
cases though

Version-Release number of selected component (if applicable): ALL


How reproducible:
Always

Steps to Reproduce:
1. compile code on URL
2. execute
3. 
    

Actual Results:  execution error

Expected Results:  non fatal errors returned from the gzprintf call

Additional info: this error is also present on the current rawhide version of 
zlib and in the older releases
Comment 1 Arenas Belon, Carlo Marcelo 2003-02-24 07:48:56 EST
Created attachment 90308 [details]
zlib 1.1.4 patch that test for [v]snprintf support and fixes overflow
Comment 2 Mark J. Cox (Product Security) 2003-02-24 09:20:04 EST
Announcement of this issue is here:
http://online.securityfocus.com/archive/1/312869
Comment 3 Jeff Johnson 2003-02-24 13:40:51 EST
FIxed in zli8b-1.1.4-8.
Comment 4 Arenas Belon, Carlo Marcelo 2003-02-24 14:02:51 EST
the Rawhide package was also affected, but this bug was introduced on zlib on 
1.0.6 (Jan 19, 1998), and therefore all of the currently suported releases are 
vulnerable.

i would recommend an errata for zlib and the packages that use it statically 
linked

even if the rawhide release (couldn't test it though as it is not yet 
available) is fixed, the zlib package i reported with the problem (the one on 
RH 7.3) needs still a fix that only an errata and not a rawhide package could 
provide IMHO
Comment 5 Jeff Johnson 2003-02-24 21:34:45 EST
A preliminary audit shows only
   rpm2html
   gimp-print
actually using gzprintf. That's hardly enough
to justify an errata, but that's not my call.

An errata will be issued if the risk is deemed
sufficiently high. Meanwhile, the patch is applied in
Raw Hide.
Comment 6 Mark J. Cox (Product Security) 2003-04-29 04:11:33 EDT
An errata has been issued which should help the problem described in this bug report. 
This report is therefore being closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files, please follow the link below. You may reopen 
this bug report if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2003-079.html

Note You need to log in before you can comment on or make changes to this bug.