OpenBSD Journal

Another patch for compress/zlib

Contributed by grey on from the not another one dept.

Thanks to Tobias Weisserth, Rob, bob, and others for writing in to let us know about a patch to address another buffer overflow in zlib.

The announcement may be found here.

Here is the patch for 3.6:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.6/common/020_libz.patch Here is the patch for 3.7: ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.7/common/005_libz.patch
The 3.6 patch also applies to OpenBSD 3.5.

As always, be sure to check http://www.openbsd.org/errata.html for any additional details.

(Comments are closed)

Comments

  1. By tamo (60.47.220.222) on

    Anyone knows the CAN or BID of this vulnerability?
    I have trouble explaining this *another* update.

    Comments

    1. By alan post (207.66.36.189) aisa@cybermesa.com on

      well, i can certainly explain it for you:

      someone rewrote the compress function in zlib after 3.4. surely it was some kind of optimization, code reorganization, or other refactor.

      at any rate, the code changed. these kinds of functions are hard to write in the face of bad data. uudecode has a non-exploitable, non-crashable buffer overrun in it right now, for instance.

      once one buffer overrun was discovered, people would naturally begin looking at the code in more detail and discovering further issues with it. if a programmer made a mistake once, they did it everywhere they used the same idiom.

      i won't be surprised to see more issues with the rewritten function, but this could also be the last one. we'll know over the next few months.

      so if you have to explain it, pitch it as a completely normal evolution of hard to write code that was just refactored. your other option is to not explain it and wait for the exploit. ;)

    2. By Anonymous Coward (65.96.221.40) on

      Bugtraq ID: 14340


      CVE: CAN-2005-1849

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]