Get the LinuxSecurity news you want faster with RSS
Powered By
Gentoo: zlib stack overflow vulnerability
Posted by LinuxSecurity.com Team
The function gzprintf() is similar in behaviour to fprintf() except that by default, this function will smash the stack if called with arguments that expand to more than Z_PRINTF_BUFSIZE (=4096 by default) bytes.
- - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200303-25
- - ---------------------------------------------------------------------
PACKAGE : zlib
SUMMARY : buffer overrun
DATE : 2003-03-28 10:50 UTC
EXPLOIT : remote
VERSIONS AFFECTED : <1.1.4-r1
FIXED VERSION : >=1.1.4-r1
CVE : CAN-2003-0107
- - ---------------------------------------------------------------------
- From advisory:
"zlib contains a function called gzprintf(). This is similar in
behaviour to fprintf() except that by default, this function will
smash the stack if called with arguments that expand to more than
Z_PRINTF_BUFSIZE (=4096 by default) bytes."
Read the full advisory at
http://www.securityfocus.com/archive/1/312869/2003-02-18/2003-02-24/0
SOLUTION
It is recommended that all Gentoo Linux users who are running
sys-libs/zlib upgrade to zlib-1.1.4-r1 as follows:
emerge sync
emerge zlib
emerge clean
- - ---------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at http://cvs.gentoo.org/~aliz
- - ---------------------------------------------------------------------
