Title: GZip Long File Name Buffer Overflow Vulnerability
Severity: MODERATE
Description:
gzip is a freely available, open source file compression utility. It is maintained and distributed by GNU.
A problem with the gzip program has been discovered that could give remote users arbitrary access. The problem is in the handling of long file names.
gzip is used to compress and decompress files using the gunzip format. Execution of the program is typically performed with the name of at least one file supplied.
gzip does not properly handle long file names. Upon execution of the program with a file name of 1028 bytes or greater, a buffer overflow occurs. This overflow could overwrite stack variables, including the return address, and be used to execute arbitrary code.
While this vulnerability isn't inherently dangerous from the command line, as the executable is not setuid, it could allow a remote user with access to the gzip program through an FTP or HTTP facility.
Affected Products:
- Debian Linux 2.2.0 68k
- Debian Linux 2.2.0 IA-32
- Debian Linux 2.2.0 alpha
- Debian Linux 2.2.0 arm
- Debian Linux 2.2.0 powerpc
- Debian Linux 2.2.0 sparc
- GNU gzip 1.2.4
- GNU gzip 1.2.4 a
- GNU gzip 1.3.0
- MandrakeSoft Corporate Server 1.0.1
- MandrakeSoft Corporate Server 2.1.0
- MandrakeSoft Corporate Server 2.1.0 x86_64
- MandrakeSoft Corporate Server 3.0.0
- MandrakeSoft Corporate Server 3.0.0 x86_64
- MandrakeSoft Linux Mandrake 10.0.0
- MandrakeSoft Linux Mandrake 10.0.0 amd64
- MandrakeSoft Linux Mandrake 10.1.0
- MandrakeSoft Linux Mandrake 10.1.0 x86_64
- MandrakeSoft Linux Mandrake 10.2.0
- MandrakeSoft Linux Mandrake 10.2.0 x86_64
- MandrakeSoft Linux Mandrake 7.0.0
- MandrakeSoft Linux Mandrake 7.1.0
- MandrakeSoft Linux Mandrake 7.2.0
- MandrakeSoft Linux Mandrake 8.0.0
- MandrakeSoft Linux Mandrake 8.0.0 ppc
- MandrakeSoft Linux Mandrake 8.1.0
- MandrakeSoft Linux Mandrake 8.1.0 ia64
- MandrakeSoft Linux Mandrake 8.2.0
- MandrakeSoft Linux Mandrake 8.2.0 ppc
- MandrakeSoft Linux Mandrake 9.0.0
- MandrakeSoft Linux Mandrake 9.1.0
- MandrakeSoft Linux Mandrake 9.1.0 ppc
- MandrakeSoft Multi Network Firewall 2.0.0
- MandrakeSoft Single Network Firewall 7.2.0
- RedHat Linux 5.2.0 alpha
- RedHat Linux 5.2.0 i386
- RedHat Linux 5.2.0 sparc
- RedHat Linux 6.0.0
- RedHat Linux 6.0.0 alpha
- RedHat Linux 6.0.0 sparc
- RedHat Linux 6.1.0 alpha
- RedHat Linux 6.1.0 i386
- RedHat Linux 6.1.0 sparc
- RedHat Linux 6.2.0 alpha
- RedHat Linux 6.2.0 i386
- RedHat Linux 6.2.0 sparc
- RedHat Linux 7.0.0 alpha
- RedHat Linux 7.0.0 i386
- RedHat Linux 7.0.0 sparc
- RedHat Linux 7.1.0 alpha
- RedHat Linux 7.1.0 i386
- RedHat Linux 7.2.0 alpha
- RedHat Linux 7.2.0 i386
- SGI IRIX 6.5.0
- SGI IRIX 6.5.1
- SGI IRIX 6.5.10
- SGI IRIX 6.5.11 f
- SGI IRIX 6.5.11 m
- SGI IRIX 6.5.12 f
- SGI IRIX 6.5.12 m
- SGI IRIX 6.5.13 f
- SGI IRIX 6.5.13 m
- SGI IRIX 6.5.14 f
- SGI IRIX 6.5.14 m
- SGI IRIX 6.5.15 f
- SGI IRIX 6.5.15 m
- SGI IRIX 6.5.2
- SGI IRIX 6.5.3
- SGI IRIX 6.5.4
- SGI IRIX 6.5.5
- SGI IRIX 6.5.6
- SGI IRIX 6.5.7
- SGI IRIX 6.5.8
- SGI IRIX 6.5.9
- Slackware Linux 7.0.0
- Slackware Linux 7.1.0
- Slackware Linux 8.0.0
- Sun Solaris 8
- Sun Solaris 8_x86
- Trustix Secure Linux 1.1.0
- Trustix Secure Linux 1.2.0
- Trustix Secure Linux 1.5.0
References:
- Gobbles: MUCH NEW BUFFEROVERFLOW FOUND IN /BIN/GZIP!
- Sun: Patch-ID# 112668-0 SunOS 5.8: /usr/bin/gzip patch
- Sun: Sun Alert ID: 44186 Security Issue with gzip(1) 1.2.4. in Solaris 8
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
