GZip Long File Name Buffer Overflow Vulnerability
BID:3712
Info
GZip Long File Name Buffer Overflow Vulnerability
| Bugtraq ID: | 3712 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2001-1228 |
| Remote: | No |
| Local: | Yes |
| Published: | Dec 18 2001 12:00AM |
| Updated: | Jul 11 2009 09:06AM |
| Credit: | This vulnerability was announced in a Gobbles Security Advisory. |
| Vulnerable: |
GNU gzip 1.3 GNU gzip 1.2.4 a GNU gzip 1.2.4 |
| Not Vulnerable: | |
Discussion
GZip Long File Name Buffer Overflow Vulnerability
gzip is a freely available, open source file compression utility. It is maintained and distributed by GNU.
gzip does not properly handle long file names. Upon execution of the program with a file name of 1028 bytes or greater, a buffer overflow occurs. This overflow could overwrite stack variables, including the return address, and be used to execute arbitrary code.
gzip is a freely available, open source file compression utility. It is maintained and distributed by GNU.
gzip does not properly handle long file names. Upon execution of the program with a file name of 1028 bytes or greater, a buffer overflow occurs. This overflow could overwrite stack variables, including the return address, and be used to execute arbitrary code.
Exploit / POC
GZip Long File Name Buffer Overflow Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
GZip Long File Name Buffer Overflow Vulnerability
Solution:
The following patch has been offered by greg <[email protected]> to fix the vulnerability:
--- gzip.c Thu Aug 19 09:39:43 1993
+++ gzip-fix.c Sun Dec 30 13:57:44 2001
@@ -1006,7 +1006,7 @@
char *dot; /* pointer to ifname extension, or NULL */
#endif
- strcpy(ifname, iname);
+ strncpy(ifname, iname, sizeof(ifname) - 1);
/* If input file exists, return OK. */
if (do_stat(ifname, sbuf) == 0) return OK;
@@ -1683,7 +1683,7 @@
}
len = strlen(dir);
if (len + NLENGTH(dp) + 1 < MAX_PATH_LEN - 1) {
- strcpy(nbuf,dir);
+ strncpy(nbuf, dir, sizeof(nbuf) - 1);
if (len != 0 /* dir = "" means current dir on Amiga */
#ifdef PATH_SEP2
&& dir[len-1] != PATH_SEP2
Various vendor-supplied fixes have been made available.
GNU gzip 1.2.4
GNU gzip 1.2.4 a
Solution:
The following patch has been offered by greg <[email protected]> to fix the vulnerability:
--- gzip.c Thu Aug 19 09:39:43 1993
+++ gzip-fix.c Sun Dec 30 13:57:44 2001
@@ -1006,7 +1006,7 @@
char *dot; /* pointer to ifname extension, or NULL */
#endif
- strcpy(ifname, iname);
+ strncpy(ifname, iname, sizeof(ifname) - 1);
/* If input file exists, return OK. */
if (do_stat(ifname, sbuf) == 0) return OK;
@@ -1683,7 +1683,7 @@
}
len = strlen(dir);
if (len + NLENGTH(dp) + 1 < MAX_PATH_LEN - 1) {
- strcpy(nbuf,dir);
+ strncpy(nbuf, dir, sizeof(nbuf) - 1);
if (len != 0 /* dir = "" means current dir on Amiga */
#ifdef PATH_SEP2
&& dir[len-1] != PATH_SEP2
Various vendor-supplied fixes have been made available.
GNU gzip 1.2.4
-
Debian 2.2 arm gzip_1.2.4-33.1_arm.deb
http://security.debian.org/dists/stable/updates/main/binary-arm/gzip_1 .2.4-33.1_arm.deb -
Debian 2.2 i386 gzip_1.2.4-33.1_i386.deb
http://security.debian.org/dists/stable/updates/main/binary-i386/gzip_ 1.2.4-33.1_i386.deb -
Debian 2.2 m68k gzip_1.2.4-33.1_m68k.deb
http://security.debian.org/dists/stable/updates/main/binary-m68k/gzip_ 1.2.4-33.1_m68k.deb -
Debian 2.2 ppc gzip_1.2.4-33.1_powerpc.deb
http://security.debian.org/dists/stable/updates/main/binary-powerpc/gz ip_1.2.4-33.1_powerpc.deb -
Debian 2.2 sparc gzip_1.2.4-33.1_sparc.deb
http://security.debian.org/dists/stable/updates/main/binary-sparc/gzip _1.2.4-33.1_sparc.deb -
Mandrake gzip-1.2.4a-9.1mdk.i586.rpm
for Linux-Mandrake 7.2 i586
http://www.mandrakesecure.net/en/ftp.php -
Mandrake gzip-1.2.4a-9.2mdk.i586.rpm
for Linux-Mandrake 7.1 i586
http://www.mandrakesecure.net/en/ftp.php -
Sun 112668-01
http://sunsolve.sun.com/pub-cgi/patchDownload.pl?target=112668&method= f
GNU gzip 1.2.4 a
-
Mandrake gzip-1.2.4a-9.1mdk.i586.rpm
for Linux-Mandrake 7.2 i586
http://www.mandrakesecure.net/en/ftp.php -
Mandrake gzip-1.2.4a-9.1mdk.i586.rpm
for Mandrake Linux 8.0 i586
http://www.mandrakesecure.net/en/ftp.php -
Mandrake gzip-1.2.4a-9.1mdk.i586.rpm
for Mandrake Linux 8.1 i586
http://www.mandrakesecure.net/en/ftp.php -
Mandrake gzip-1.2.4a-9.1mdk.i586.rpm
for Single Network Firewall 7.2 i586
http://www.mandrakesecure.net/en/ftp.php -
Mandrake gzip-1.2.4a-9.1mdk.ia64.rpm
for Mandrake Linux 8.1 ia64
http://www.mandrakesecure.net/en/ftp.php -
Mandrake gzip-1.2.4a-9.1mdk.ppc.rpm
for Mandrake Linux 8.0 ppc
http://www.mandrakesecure.net/en/ftp.php -
Mandrake gzip-1.2.4a-9.2mdk.i586.rpm
for Corporate Server 1.0.1 i586
http://www.mandrakesecure.net/en/ftp.php -
Mandrake gzip-1.2.4a-9.2mdk.i586.rpm
for Linux-Mandrake 7.1 i586
http://www.mandrakesecure.net/en/ftp.php -
Trustix gzip-1.2.4a-18tr.i586.rpm
Release 1.1
ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/gzip-1.2.4a-18tr.i5 86.rpm -
Trustix gzip-1.2.4a-18tr.i586.rpm
Release 1.2
ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/gzip-1.2.4a-18tr.i5 86.rpm -
Trustix gzip-1.2.4a-18tr.i586.rpm
Release 1.5
ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/gzip-1.2.4a-18tr.i5 86.rpm -
Trustix gzip-doc-1.2.4a-18tr.i586.rpm
Release 1.1
ftp://ftp.trustix.net/pub/Trustix/updates/1.1/RPMS/gzip-doc-1.2.4a-18t r.i586.rpm -
Trustix gzip-doc-1.2.4a-18tr.i586.rpm
Release 1.2
ftp://ftp.trustix.net/pub/Trustix/updates/1.2/RPMS/gzip-doc-1.2.4a-18t r.i586.rpm -
Trustix gzip-doc-1.2.4a-18tr.i586.rpm
Release 1.5
ftp://ftp.trustix.net/pub/Trustix/updates/1.5/RPMS/gzip-doc-1.2.4a-18t r.i586.rpm
References
GZip Long File Name Buffer Overflow Vulnerability
References:
References: