Summary: | {app-arch/ncompress|dev-libs/liblzw} 4.2.4 security flaw in decompression | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Sune Kloppenborg Jeppesen (RETIRED) <jaervosz> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | normal | CC: | bernd, chainsaw, tcort |
Priority: | High | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | B2 [glsa] DerCorny | ||
Package list: | Runtime testing required: | --- |
Description
Sune Kloppenborg Jeppesen (RETIRED)
2006-07-25 11:59:32 UTC
mhh vapier, this looks like something for you. can you provide new ebuilds? thanks in advance not really ... ncompress was put into the public domain long ago and has since seen no updates and has no upstream we'll need to fix this ourselves (or steal a fix from another distro) ... pmasking/punting is not an acceptable solution might also be worth noting that my dev-libs/liblzw package is also vuln as the decompressing code in there is taken straight from ncompress Mike: We have a fix for this one; I'll attach it here when it's finalized :) I think this is public now though I haven't seen any advisories yet. Ok, this is public? Tim, can you attach the fix you spoke about? Vapier, any news on this one? Vapier, any news on this one? why would i have news ? last comment here is from Tim saying he's going to be posting the fix real soon now ... i dont have access to the lists where this fix was discussed Tim could you attach the fix here, I guess your mail from a few weeks back got lost somewhere. Tim could you attach the fix here, I guess your mail from a few weeks back got lost somewhere. [18:22] <plasmaroo> jaervosz: Tavis sent spanky the patch for that one Vapier please bump. isnt the unlzw code in gzip also vuln ? (In reply to comment #12) > isnt the unlzw code in gzip also vuln ? > no. because it has this change ? if (oldcode == -1) { + if (code >= 256) error("corrupt input."); outbuf[outpos++] = (char_type)(finchar = (int)(oldcode=code)); continue; } perhaps we should use this patch for our other things then ? Sure, although I prefer the bounds checking approach, as any flaw discovered in future will be rendered harmless. Either fix will be fine. liblzw-0.1.1 now in portage ncompress-4.2.4.1 now in portage arches pls test app-arch/ncompress-4.2.4.1 and mark stable if possible libzlw has not been stable on any arch anyways Marked app-arch/ncompress-4.2.4.1 ppc64 stable ppc stable liblzw: 1.) emerges fine on x86 2.) passes collision test 3.) ncompress compiles with it ncompress: 1.) emerges fine on x86 2.) passes collision test 3.) works emerge --info Portage 2.1.1 (default-linux/x86/2006.1/desktop, gcc-4.1.1, glibc-2.4-r3, 2.6.18 i686) ================================================================= System uname: 2.6.18 i686 Genuine Intel(R) CPU T2300 @ 1.66GHz Gentoo Base System version 1.12.5 Last Sync: Fri, 29 Sep 2006 13:50:01 +0000 ccache version 2.3 [disabled] app-admin/eselect-compiler: [Not Present] dev-java/java-config: 1.2.11-r1 dev-lang/python: 2.3.5-r3, 2.4.3-r4 dev-python/pycrypto: 2.0.1-r5 dev-util/ccache: 2.3 dev-util/confcache: [Not Present] sys-apps/sandbox: 1.2.17 sys-devel/autoconf: 2.13, 2.59-r7 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2 sys-devel/binutils: 2.16.1-r3 sys-devel/gcc-config: 1.3.13-r3 sys-devel/libtool: 1.5.22 virtual/os-headers: 2.6.17-r1 ACCEPT_KEYWORDS="x86" AUTOCLEAN="yes" CBUILD="i686-pc-linux-gnu" CFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer" CHOST="i686-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config /usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/ /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/ /usr/share/texmf/xdvi/" CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/terminfo" CXXFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer" DISTDIR="/usr/portage/distfiles" FEATURES="autoconfig collision-protect distlocks metadata-transfer parallel-fetch sandbox sfperms strict test userfetch userpriv usersandbox" GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo" LINGUAS="en de en_GB de_CH" MAKEOPTS="-j3" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" SYNC="rsync://192.168.2.1/gentoo-portage" USE="x86 X a52 aac acpi alsa apache2 asf berkdb bitmap-fonts cairo cdr cdrom cli crypt cups dbus divx dlloader dri dts dvd dvdr dvdread eds elibc_glibc emboss encode fam ffmpeg firefox flac fortran gdbm gif gnome gpm gstreamer gtk hal input_devices_keyboard input_devices_mouse ipv6 isdnlog java jpeg kde kernel_linux ldap libg++ linguas_de linguas_de_CH linguas_en linguas_en_GB mad mikmod mmx mono mp3 mpeg ncurses nls nptl nptlonly ogg opengl oss pam pcre perl png ppds pppd python qt3 qt4 quicktime readline reflection rtsp samba sdl session smp spell spl sse sse2 sse3 ssl svg tcpd tetex theora threads truetype truetype-fonts type1-fonts udev unicode userland_GNU vcd video_cards_fbdev video_cards_i810 video_cards_vesa vorbis win32codecs wxwindows x264 xine xml xorg xprint xv xvid zlib" Unset: CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY ncompress stable on SPARC. We don't have liblzw keywords so we haven't touched that. 1. both emerge fine on amd64 2. both passed collision test 3. both passed multi-lib strict 4. compressed a file with ncompress and it worked fine, liblzw is ripped right from ncompress so i would expect similar results emerge --info follows ----------------------------------------------------------------------------- Portage 2.1.1-r1 (default-linux/amd64/2006.1/desktop, gcc-4.1.1, glibc-2.4-r3, 2.6.17-beyond4 x86_64) ================================================================= System uname: 2.6.17-beyond4 x86_64 AMD Athlon(tm) 64 Processor 3200+ Gentoo Base System version 1.12.5 Last Sync: Mon, 02 Oct 2006 13:30:01 +0000 ccache version 2.3 [enabled] app-admin/eselect-compiler: [Not Present] dev-java/java-config: 1.3.7, 2.0.30 dev-lang/python: 2.4.3-r4 dev-python/pycrypto: 2.0.1-r5 dev-util/ccache: 2.3 dev-util/confcache: [Not Present] sys-apps/sandbox: 1.2.17 sys-devel/autoconf: 2.13, 2.59-r7 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2 sys-devel/binutils: 2.16.1-r3 sys-devel/gcc-config: 1.3.13-r4 sys-devel/libtool: 1.5.22 virtual/os-headers: 2.6.11-r2 ACCEPT_KEYWORDS="amd64" AUTOCLEAN="yes" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -msse3 -march=k8 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/X11/xkb /usr/share/config" CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/java-config/vms/ /etc/revdep-rebuild /etc/terminfo" CXXFLAGS="-O2 -msse3 -march=k8 -pipe" DISTDIR="/usr/portage/distfiles" FEATURES="autoconfig ccache collision-protect distlocks metadata-transfer multilib-strict sandbox sfperms strict test" GENTOO_MIRRORS="http://mirror.datapipe.net/gentoo http://gentoo.cites.uiuc.edu/pub/gentoo/ http://mirrors.acm.cs.rpi.edu/gentoo/" LINGUAS="en en_US" MAKEOPTS="-j2" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/overlays" SYNC="rsync://rsync.gentoo.org/gentoo-portage" USE="amd64 X a52 aac acl acpi akobe alsa apache2 audiofile avi bash-completion bcp berkdb bitmap-fonts bjam bogofilter boost branding bzip2 cairo cdr cli crypt cscope cups curl dbus djbfft dlloader dri dssi dts dvd dvdr dvdread eds elibc_glibc emboss encode exif expat exscalibar fam ffmpeg firefox flac foo2zjs_devices_hp1020 foomaticdb fortran fpx ftp gd gdbm gif glitz glut gmp gnokii gnome gnutls gphoto2 gpm graphviz gs gsl gstreamer gtk gtk2 guile hal hash ieee1394 imlib input_devices_keyboard input_devices_mouse insecure-savers ipv6 isdnlog jack jack-tmpfs jackmidi java jbig jpeg jpeg2k kernel_linux lapack lash lcms ldap libg++ linguas_en linguas_en_US logitech-mouse mad mailwrapper mikmod mono mp3 mp4 mpeg musicbrainz mysql ncurses network nls nptl nptlonly nsplugin numeric offensive ogg openal openexr opengl pam pam_console pcre pda pdf pdflib perl physfs png ppds pppd pwdb pyste python quicktime readline reflection ruby samba sdl session speex spell spl sqlite ssl svg tcl tcpd theora threads tidy tiff truetype truetype-fonts type1-fonts udev unicode userland_GNU video_cards_nvidia visualization vorbis vst wmf xcomposite xine xml xmms xorg xscreensaver xv xvid xvmc yahoo zlib" Unset: CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS amd64 done x86 is stable yay ?_? ncompress stable on alpha. We don't have liblzw keywords so we haven't touched that. Sorry for the delay. Stable on hppa. Thanks everybody GLSA 200610-03 |