Vulnerability Note VU#142121

zlib "gzprintf()" function vulnerable to buffer overflow

Overview

A buffer overflow exists in one of the functions included with the zlib compression library. This vulnerability may allow a remote attacker to execute arbitrary code or cause a denial of service. An exploit for this vulnerability is publicly available.

I. Description

The zlib website describes zlib as a "...lossless data-compression library for use on virtually any computer hardware and operating system." A buffer overflow exists in the gzprintf function contained within the zlib compression library. For more detailed information, please see Richard Kettlewell's advisory.

II. Impact

A remote attacker may be able to execute code or cause a denial of service.

III. Solution

Apply a vendor patch.

Systems Affected

Vendor	Status	Date Notified
3Com	Unknown	23-May-2003
Adobe Systems Incorporated	Unknown	23-May-2003
Alcatel	Unknown	23-May-2003
Apple Computer, Inc.	Not Vulnerable	2-Jun-2003
AT&T	Unknown	23-May-2003
Avaya	Unknown	23-May-2003
Berkeley Software Design, Inc.	Unknown	23-May-2003
Cisco Systems, Inc.	Unknown	23-May-2003
Computer Associates	Unknown	23-May-2003
Cray Inc.	Unknown	23-May-2003
D-Link Systems	Unknown	23-May-2003
Data General	Unknown	23-May-2003
Debian Linux	Unknown	23-May-2003
Engarde	Unknown	23-May-2003
Extreme Networks	Unknown	23-May-2003
F5 Networks, Inc.	Unknown	23-May-2003
Foundry Networks Inc.	Not Vulnerable	2-Jun-2003
FreeBSD, Inc.	Unknown	23-May-2003
Fujitsu	Not Vulnerable	5-Jun-2003
Gentoo Linux	Vulnerable	23-May-2003
Hewlett-Packard Company	Unknown	23-May-2003
Hitachi	Not Vulnerable	14-Jul-2003
IBM-zSeries	Unknown	23-May-2003
IBM Corporation	Vulnerable	27-May-2003
Ingrian Networks, Inc.	Unknown	23-May-2003
Intel	Unknown	23-May-2003
Juniper Networks, Inc.	Unknown	23-May-2003
Lachman	Unknown	23-May-2003
Lotus Software	Unknown	23-May-2003
Lucent Technologies	Unknown	23-May-2003
Mandriva, Inc.	Vulnerable	8-Sep-2004
Mandriva, Inc.	Vulnerable	23-May-2003
Mandriva, Inc.	Unknown	23-May-2003
Microsoft Corporation	Unknown	23-May-2003
MontaVista Software, Inc.	Unknown	23-May-2003
Multi-Tech Systems Inc.	Unknown	23-May-2003
Multinet	Unknown	23-May-2003
NEC Corporation	Unknown	23-May-2003
NetBSD	Vulnerable	23-May-2003
Netscreen	Unknown	23-May-2003
Network Appliance	Unknown	23-May-2003
NeXT	Unknown	23-May-2003
Nokia	Unknown	23-May-2003
Nortel Networks, Inc.	Unknown	23-May-2003
OpenBSD	Unknown	23-May-2003
OpenPKG	Vulnerable	23-May-2003
Openwall GNU/*/Linux	Vulnerable	2-Jun-2003
Oracle Corporation	Unknown	23-May-2003
Red Hat, Inc.	Vulnerable	27-May-2003
Riverstone Networks	Unknown	23-May-2003
SCO	Vulnerable	23-May-2003
Sequent Computer Systems, Inc.	Unknown	23-May-2003
SGI	Unknown	23-May-2003
Sony Corporation	Unknown	23-May-2003
Sun Microsystems, Inc.	Unknown	23-May-2003
SUSE Linux	Vulnerable	24-Jun-2003
Unisys	Unknown	23-May-2003
Wind River Systems, Inc.	Unknown	23-May-2003
Wirex	Unknown	23-May-2003
Xerox Corporation	Not Vulnerable	12-Jun-2003
Xpdf	Not Vulnerable	3-Jun-2003
ZyXEL	Unknown	23-May-2003

References

http://www.gzip.org/zlib/
http://online.securityfocus.com/bid/6913
http://securityfocus.org/archive/1/312869
http://www.securityfocus.com/archive/1/312869
http://www.iss.net/security_center/static/11381.php
http://secunia.com/advisories/24788
http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&externalId=3616065
http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&externalId=9916286

Credit

This vulnerability was discovered by Richard Kettlewell.

This document was written by Ian A Finlay.

Other Information

Date Public:	2003-02-22
Date First Published:	2003-05-23
Date Last Updated:	2008-06-06
CERT Advisory:
CVE-ID(s):	CVE-2003-0107
NVD-ID(s):	CVE-2003-0107
US-CERT Technical Alerts:
Severity Metric:	29.11
Document Revision:	11

If you have feedback, comments, or additional information about this vulnerability, please send us email.