Hi there, an audit of ncompress version 4.2.4 uncovered a serious security flaw, this loop in decompress() (~1749, compress42.c) performs no bounds checking, allowing a specially crafted datastream to underflow a .bss buffer with attacker controlled data. Some research reveals that the lzw decompressors from gzip and openbsd (both derived from the same public domain implementation) have already corrected this flaw, however ncompress shipped by (at least) gentoo, debian, fedora and suse seem to still be vulnerable. while ((cmp_code_int)code >= (cmp_code_int)256) { /* Generate output characters in reverse order */ *--stackp = tab_suffixof(code); code = tab_prefixof(code); } In my test environment I've been able to successfully overwirte .got and .dtors with controlled data. The most simple testcase would be: $ perl -e 'print "\x1f\x9d\x90","\x01"x"2048"' | compress -d My suggested fix would be adding `&& stackp >= htabof(0)` to the loop condition. As far as I'm aware, this package is no longer actively maintained by any upstream author. If there are no objections, I'll suggest an embargo date of Tuesday 8th August, 14:00 UTC. Please credit "Tavis Ormandy, Google Security Team" on any advisory relating to this issue. Thanks, Tavis.
mhh vapier, this looks like something for you. can you provide new ebuilds? thanks in advance
not really ... ncompress was put into the public domain long ago and has since seen no updates and has no upstream we'll need to fix this ourselves (or steal a fix from another distro) ... pmasking/punting is not an acceptable solution might also be worth noting that my dev-libs/liblzw package is also vuln as the decompressing code in there is taken straight from ncompress
Mike: We have a fix for this one; I'll attach it here when it's finalized :)
I think this is public now though I haven't seen any advisories yet.
Ok, this is public? Tim, can you attach the fix you spoke about?
Vapier, any news on this one?
why would i have news ? last comment here is from Tim saying he's going to be posting the fix real soon now ... i dont have access to the lists where this fix was discussed
Tim could you attach the fix here, I guess your mail from a few weeks back got lost somewhere.
[18:22] <plasmaroo> jaervosz: Tavis sent spanky the patch for that one Vapier please bump.
isnt the unlzw code in gzip also vuln ?
(In reply to comment #12) > isnt the unlzw code in gzip also vuln ? > no.
because it has this change ? if (oldcode == -1) { + if (code >= 256) error("corrupt input."); outbuf[outpos++] = (char_type)(finchar = (int)(oldcode=code)); continue; } perhaps we should use this patch for our other things then ?
Sure, although I prefer the bounds checking approach, as any flaw discovered in future will be rendered harmless. Either fix will be fine.
liblzw-0.1.1 now in portage ncompress-4.2.4.1 now in portage
arches pls test app-arch/ncompress-4.2.4.1 and mark stable if possible libzlw has not been stable on any arch anyways
Marked app-arch/ncompress-4.2.4.1 ppc64 stable
ppc stable
liblzw: 1.) emerges fine on x86 2.) passes collision test 3.) ncompress compiles with it ncompress: 1.) emerges fine on x86 2.) passes collision test 3.) works emerge --info Portage 2.1.1 (default-linux/x86/2006.1/desktop, gcc-4.1.1, glibc-2.4-r3, 2.6.18 i686) ================================================================= System uname: 2.6.18 i686 Genuine Intel(R) CPU T2300 @ 1.66GHz Gentoo Base System version 1.12.5 Last Sync: Fri, 29 Sep 2006 13:50:01 +0000 ccache version 2.3 [disabled] app-admin/eselect-compiler: [Not Present] dev-java/java-config: 1.2.11-r1 dev-lang/python: 2.3.5-r3, 2.4.3-r4 dev-python/pycrypto: 2.0.1-r5 dev-util/ccache: 2.3 dev-util/confcache: [Not Present] sys-apps/sandbox: 1.2.17 sys-devel/autoconf: 2.13, 2.59-r7 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2 sys-devel/binutils: 2.16.1-r3 sys-devel/gcc-config: 1.3.13-r3 sys-devel/libtool: 1.5.22 virtual/os-headers: 2.6.17-r1 ACCEPT_KEYWORDS="x86" AUTOCLEAN="yes" CBUILD="i686-pc-linux-gnu" CFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer" CHOST="i686-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config /usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/ /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/ /usr/share/texmf/xdvi/" CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/terminfo" CXXFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer" DISTDIR="/usr/portage/distfiles" FEATURES="autoconfig collision-protect distlocks metadata-transfer parallel-fetch sandbox sfperms strict test userfetch userpriv usersandbox" GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/linux/distributions/gentoo" LINGUAS="en de en_GB de_CH" MAKEOPTS="-j3" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" SYNC="rsync://192.168.2.1/gentoo-portage" USE="x86 X a52 aac acpi alsa apache2 asf berkdb bitmap-fonts cairo cdr cdrom cli crypt cups dbus divx dlloader dri dts dvd dvdr dvdread eds elibc_glibc emboss encode fam ffmpeg firefox flac fortran gdbm gif gnome gpm gstreamer gtk hal input_devices_keyboard input_devices_mouse ipv6 isdnlog java jpeg kde kernel_linux ldap libg++ linguas_de linguas_de_CH linguas_en linguas_en_GB mad mikmod mmx mono mp3 mpeg ncurses nls nptl nptlonly ogg opengl oss pam pcre perl png ppds pppd python qt3 qt4 quicktime readline reflection rtsp samba sdl session smp spell spl sse sse2 sse3 ssl svg tcpd tetex theora threads truetype truetype-fonts type1-fonts udev unicode userland_GNU vcd video_cards_fbdev video_cards_i810 video_cards_vesa vorbis win32codecs wxwindows x264 xine xml xorg xprint xv xvid zlib" Unset: CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY
ncompress stable on SPARC. We don't have liblzw keywords so we haven't touched that.
1. both emerge fine on amd64 2. both passed collision test 3. both passed multi-lib strict 4. compressed a file with ncompress and it worked fine, liblzw is ripped right from ncompress so i would expect similar results emerge --info follows ----------------------------------------------------------------------------- Portage 2.1.1-r1 (default-linux/amd64/2006.1/desktop, gcc-4.1.1, glibc-2.4-r3, 2.6.17-beyond4 x86_64) ================================================================= System uname: 2.6.17-beyond4 x86_64 AMD Athlon(tm) 64 Processor 3200+ Gentoo Base System version 1.12.5 Last Sync: Mon, 02 Oct 2006 13:30:01 +0000 ccache version 2.3 [enabled] app-admin/eselect-compiler: [Not Present] dev-java/java-config: 1.3.7, 2.0.30 dev-lang/python: 2.4.3-r4 dev-python/pycrypto: 2.0.1-r5 dev-util/ccache: 2.3 dev-util/confcache: [Not Present] sys-apps/sandbox: 1.2.17 sys-devel/autoconf: 2.13, 2.59-r7 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2 sys-devel/binutils: 2.16.1-r3 sys-devel/gcc-config: 1.3.13-r4 sys-devel/libtool: 1.5.22 virtual/os-headers: 2.6.11-r2 ACCEPT_KEYWORDS="amd64" AUTOCLEAN="yes" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -msse3 -march=k8 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/X11/xkb /usr/share/config" CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/java-config/vms/ /etc/revdep-rebuild /etc/terminfo" CXXFLAGS="-O2 -msse3 -march=k8 -pipe" DISTDIR="/usr/portage/distfiles" FEATURES="autoconfig ccache collision-protect distlocks metadata-transfer multilib-strict sandbox sfperms strict test" GENTOO_MIRRORS="http://mirror.datapipe.net/gentoo http://gentoo.cites.uiuc.edu/pub/gentoo/ http://mirrors.acm.cs.rpi.edu/gentoo/" LINGUAS="en en_US" MAKEOPTS="-j2" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/overlays" SYNC="rsync://rsync.gentoo.org/gentoo-portage" USE="amd64 X a52 aac acl acpi akobe alsa apache2 audiofile avi bash-completion bcp berkdb bitmap-fonts bjam bogofilter boost branding bzip2 cairo cdr cli crypt cscope cups curl dbus djbfft dlloader dri dssi dts dvd dvdr dvdread eds elibc_glibc emboss encode exif expat exscalibar fam ffmpeg firefox flac foo2zjs_devices_hp1020 foomaticdb fortran fpx ftp gd gdbm gif glitz glut gmp gnokii gnome gnutls gphoto2 gpm graphviz gs gsl gstreamer gtk gtk2 guile hal hash ieee1394 imlib input_devices_keyboard input_devices_mouse insecure-savers ipv6 isdnlog jack jack-tmpfs jackmidi java jbig jpeg jpeg2k kernel_linux lapack lash lcms ldap libg++ linguas_en linguas_en_US logitech-mouse mad mailwrapper mikmod mono mp3 mp4 mpeg musicbrainz mysql ncurses network nls nptl nptlonly nsplugin numeric offensive ogg openal openexr opengl pam pam_console pcre pda pdf pdflib perl physfs png ppds pppd pwdb pyste python quicktime readline reflection ruby samba sdl session speex spell spl sqlite ssl svg tcl tcpd theora threads tidy tiff truetype truetype-fonts type1-fonts udev unicode userland_GNU video_cards_nvidia visualization vorbis vst wmf xcomposite xine xml xmms xorg xscreensaver xv xvid xvmc yahoo zlib" Unset: CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS
amd64 done
x86 is stable yay ?_?
ncompress stable on alpha. We don't have liblzw keywords so we haven't touched that. Sorry for the delay.
Stable on hppa.
Thanks everybody GLSA 200610-03
