LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: April 7th, 2014
Linux Advisory Watch: April 4th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
RedHat: Important: zlib security update Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
RedHat Linux Updated zlib packages that fix a buffer overflow are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team.
- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Important: zlib security update
Advisory ID:       RHSA-2005:584-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2005-584.html
Issue date:        2005-07-21
Updated on:        2005-07-21
Product:           Red Hat Enterprise Linux
Obsoletes:         RHSA-2005:569
CVE Names:         CAN-2005-1849
- ---------------------------------------------------------------------

1. Summary:

Updated zlib packages that fix a buffer overflow are now available for Red
Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

Zlib is a general-purpose lossless data compression library that is used
by many different programs.

A previous zlib update, RHSA-2005:569 (CAN-2005-2096) fixed a flaw in zlib
that could allow a carefully crafted compressed stream to crash an
application. While the original patch corrected the reported overflow,
Markus Oberhumer discovered additional ways a stream could trigger an
overflow.  An attacker could create a carefully crafted compressed stream
that would cause an application to crash if the stream is opened by a user.
 As an example, an attacker could create a malicious PNG image file that
would cause a Web browser or mail viewer to crash if the image is viewed.
The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned
the name CAN-2005-1849 to this issue.

Note that the versions of zlib shipped with Red Hat Enterprise
Linux 2.1 and 3 are not vulnerable to this issue.

All users should update to these errata packages that contain a patch
from Mark Adler that corrects this issue.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

163037 - CAN-2005-1849 zlib buffer overflow


6. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/zlib-1.2.1.2-1.2.src.rpm
53285b12c3dd5df4124d06fb883babad  zlib-1.2.1.2-1.2.src.rpm

i386:
30f929114a8ea2b081ce351d3d246d28  zlib-1.2.1.2-1.2.i386.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e  zlib-devel-1.2.1.2-1.2.i386.rpm

ia64:
30f929114a8ea2b081ce351d3d246d28  zlib-1.2.1.2-1.2.i386.rpm
1312f81b44238af7a12e6d129c2a4214  zlib-1.2.1.2-1.2.ia64.rpm
8c33f481ebacb03cd7e4a14260ca99fe  zlib-devel-1.2.1.2-1.2.ia64.rpm

ppc:
d9cd4122eccc130ec2a6d7c64444c3b9  zlib-1.2.1.2-1.2.ppc.rpm
c2191b6f367b068c5aadad73bbf22c5c  zlib-1.2.1.2-1.2.ppc64.rpm
961c16ee93912237b347328f73fa3c9b  zlib-devel-1.2.1.2-1.2.ppc.rpm
235b2aec2af9595771b10218ec467635  zlib-devel-1.2.1.2-1.2.ppc64.rpm

s390:
7efc2375f317b93d57d360cd4ac5a296  zlib-1.2.1.2-1.2.s390.rpm
942b1745f31f9719a6c0a8d5c7fef689  zlib-devel-1.2.1.2-1.2.s390.rpm

s390x:
7efc2375f317b93d57d360cd4ac5a296  zlib-1.2.1.2-1.2.s390.rpm
2fddcbebe2083e23a16353719f241c44  zlib-1.2.1.2-1.2.s390x.rpm
942b1745f31f9719a6c0a8d5c7fef689  zlib-devel-1.2.1.2-1.2.s390.rpm
6797b66922691f00c5f6c1454c2522fe  zlib-devel-1.2.1.2-1.2.s390x.rpm

x86_64:
30f929114a8ea2b081ce351d3d246d28  zlib-1.2.1.2-1.2.i386.rpm
2888c31cba9b579a69c08fb52a6464b3  zlib-1.2.1.2-1.2.x86_64.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e  zlib-devel-1.2.1.2-1.2.i386.rpm
9c789749e4d9a8e051f884cc29f307aa  zlib-devel-1.2.1.2-1.2.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/zlib-1.2.1.2-1.2.src.rpm
53285b12c3dd5df4124d06fb883babad  zlib-1.2.1.2-1.2.src.rpm

i386:
30f929114a8ea2b081ce351d3d246d28  zlib-1.2.1.2-1.2.i386.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e  zlib-devel-1.2.1.2-1.2.i386.rpm

x86_64:
30f929114a8ea2b081ce351d3d246d28  zlib-1.2.1.2-1.2.i386.rpm
2888c31cba9b579a69c08fb52a6464b3  zlib-1.2.1.2-1.2.x86_64.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e  zlib-devel-1.2.1.2-1.2.i386.rpm
9c789749e4d9a8e051f884cc29f307aa  zlib-devel-1.2.1.2-1.2.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/zlib-1.2.1.2-1.2.src.rpm
53285b12c3dd5df4124d06fb883babad  zlib-1.2.1.2-1.2.src.rpm

i386:
30f929114a8ea2b081ce351d3d246d28  zlib-1.2.1.2-1.2.i386.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e  zlib-devel-1.2.1.2-1.2.i386.rpm

ia64:
30f929114a8ea2b081ce351d3d246d28  zlib-1.2.1.2-1.2.i386.rpm
1312f81b44238af7a12e6d129c2a4214  zlib-1.2.1.2-1.2.ia64.rpm
8c33f481ebacb03cd7e4a14260ca99fe  zlib-devel-1.2.1.2-1.2.ia64.rpm

x86_64:
30f929114a8ea2b081ce351d3d246d28  zlib-1.2.1.2-1.2.i386.rpm
2888c31cba9b579a69c08fb52a6464b3  zlib-1.2.1.2-1.2.x86_64.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e  zlib-devel-1.2.1.2-1.2.i386.rpm
9c789749e4d9a8e051f884cc29f307aa  zlib-devel-1.2.1.2-1.2.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/zlib-1.2.1.2-1.2.src.rpm
53285b12c3dd5df4124d06fb883babad  zlib-1.2.1.2-1.2.src.rpm

i386:
30f929114a8ea2b081ce351d3d246d28  zlib-1.2.1.2-1.2.i386.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e  zlib-devel-1.2.1.2-1.2.i386.rpm

ia64:
30f929114a8ea2b081ce351d3d246d28  zlib-1.2.1.2-1.2.i386.rpm
1312f81b44238af7a12e6d129c2a4214  zlib-1.2.1.2-1.2.ia64.rpm
8c33f481ebacb03cd7e4a14260ca99fe  zlib-devel-1.2.1.2-1.2.ia64.rpm

x86_64:
30f929114a8ea2b081ce351d3d246d28  zlib-1.2.1.2-1.2.i386.rpm
2888c31cba9b579a69c08fb52a6464b3  zlib-1.2.1.2-1.2.x86_64.rpm
bf96769c3fb67abb62f3bc4d0b0a0d5e  zlib-devel-1.2.1.2-1.2.i386.rpm
9c789749e4d9a8e051f884cc29f307aa  zlib-devel-1.2.1.2-1.2.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1849

8. Contact:

The Red Hat security contact is .  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2005 Red Hat, Inc.
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Heartbleed: Security experts reality-check the 3 most hysterical fears
Open source trounces proprietary software for code defects, Coverity analysis finds
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.