Bugzilla Bug 61749

Debian Bug that triggered the following advisory:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=252253

-----------

Package:             zlib
Vulnerability:       denial of service
OpenPKG Specific:    no

Affected Releases:   Affected Packages:           Corrected Packages:
OpenPKG CURRENT      <= zlib-1.2.1-20040207       >= zlib-1.2.1-20040825
                     <= ghostscript-8.14-20040816 >= ghostscript-8.14-20040825
                     <= openpkg-20040811-20040811 >= openpkg-20040825-20040825
OpenPKG 2.1          <= zlib-1.2.1-2.1.0          >= zlib-1.2.1-2.1.1
                     <= ghostscript-8.14-2.1.1    >= ghostscript-8.14-2.1.2
                     <= openpkg-2.1.1-2.1.1       >= openpkg-2.1.2-2.1.2
OpenPKG 2.0          <= zlib-1.2.1-2.0.0          >= zlib-1.2.1-2.0.1
                     <= ghostscript-8.13-2.0.3    >= ghostscript-8.13-2.0.4
                     <= openpkg-2.0.3-2.0.3       >= openpkg-2.0.4-2.0.4

Dependent Packages:  
[...]

Description:
  Triggered by a Debian bug report [1], a denial of service vulnerability
  was found in the ZLib compression library [0] versions 1.2.x
  (older versions are not affected). The problem arises from incorrect
  error handling in the inflate() and inflateBack() functions. The
  Common Vulnerabilities and Exposures (CVE) project assigned the id
  CAN-2004-0797 [2] to the problem.

  Please check whether you are affected by running "<prefix>/bin/openpkg
  rpm -q zlib". If you have the "zlib" package installed and its version
  is affected (see above), we recommend that you immediately upgrade it
  (see Solution) and its dependent packages (see above) as well [3][4].

[...]

Created an attachment (id=38229) [details]
Patch used by OpenPKG

Attachment contains the patch against zlib-1.2.1 used by OpenPKG (patching
infback.c and inflate.c)

base-system please verify and provide an updated ebuild if needed.


Debian seems to be fixing it:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=252253

I can't verify the vuln is real without a test case which means I can't verify
the patch does what it's supposed to.
Sorry the only thing I can verify is that it patches clean, rebuilds and a few
things that link to zlib still work.

I've put zlib-1.2.1-r3 in the tree however with the OpenPKG patch named as
zlib-1.2.1-CAN-2004-0797.patch
KEYWORDS="~x86 ~ppc ~sparc ~mips ~alpha ~arm ~hppa ~amd64 ~ia64 ~ppc64 ~s390"

Note: A revdep-rebuild probably should be done for any package that linked with
the libzlib.a or uses zlib in a static environment.

To get an idea try doing.
/usr/bin/revdep-rebuild -X zlib -pv

marked stable for arm/hppa/amd64/ia64

Arches please mark zlib-1.2.1-r3 stable

sparc stable.

Stable on x86

ppc/alpha is now stable

mips stable too now too

stable on ppc64 

This is ready for GLSA. Security please draft and condordes double check.

GLSA drafted. Security please review.

Debian seems to patch those two files in the same way. Although the upload is
not in their pool yet, it can be found at http://incoming.debian.org/
(http://incoming.debian.org/zlib_1.2.1.1-7.diff.gz).
The new Changelog for zlib there says:

+zlib (1:1.2.1.1-6) testing; urgency=high
+
+  * Fix the error handling in the new inflate implementation to avoid
+    incorrectly continuing to process in the error state.  Thanks to Johan
+    Thelmén <johan.thelmen@cygate.se> for his help in finding and fixing this
+    bug.  This is CAN-2004-0797 (closes: #252253).

Debian seems to patch those two files in the same way. Although the upload is
not in their pool yet, it can be found at http://incoming.debian.org/
(http://incoming.debian.org/zlib_1.2.1.1-7.diff.gz).
The new Changelog for zlib there says:

+zlib (1:1.2.1.1-6) testing; urgency=high
+
+  * Fix the error handling in the new inflate implementation to avoid
+    incorrectly continuing to process in the error state.  Thanks to Johan
+    Thelmén <johan.thelmen@cygate.se> for his help in finding and fixing
this
+    bug.  This is CAN-2004-0797 (closes: #252253).

GLSA 200406-26

The ebuild definetely should warn about static linked binaries and provide
instructions on how to rebuild them!

s390 stable

*** Bug 69877 has been marked as a duplicate of this bug. ***