Red Hat セキュリティアドバイザリ 2006:0667 から：

いくつかのセキュリティの問題を修正する更新済みの gzip　パッケージが、Red Hat Enterprise Linux で現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新は重要度中のセキュリティ影響があると評価しています。

gzip パッケージは GNU gzip データ圧縮プログラムを含んでいます。

Google セキュリティチームの Tavis Ormandy 氏は、gzip がアーカイブファイルを展開する方法で 2 つのサービス拒否の欠陥を発見しました。被害者が特別に細工されたアーカイブを展開すると、gzip の実行ファイルがハングアップしたり、クラッシュしたりする可能性があります。（CVE-2006-4334、 CVE-2006-4338）

Google セキュリティチームの Tavis Ormandy 氏は、gzip がアーカイブファイルを展開する方法でいくつかのコード実行の欠陥を発見しました。被害者が特別に細工されたアーカイブを展開すると、gzip の実行ファイルがクラッシュしたり、任意のコードを実行したりする可能性があります。（CVE-2006-4335、 CVE-2006-4336、CVE-2006-4337）

gzip のユーザーは、これらの問題に対する脆弱性がない、バックポートされたパッチが含まれるこれらの更新済みパッケージへアップグレードする必要があります。

s700_800 11.11 Software Distributor Cumulative Patch : 

A potential security vulnerability has been identified with the version of GZIP delivered by HP-UX Software Distributor (SD). The vulnerability could be remotely exploited leading to a Denial of Service (DoS).

The remote host is affected by the vulnerability described in GLSA-200609-13 (gzip: Multiple vulnerabilities)

    Tavis Ormandy of the Google Security Team has reported multiple     vulnerabilities in gzip. A stack buffer modification vulnerability was     discovered in the LZH decompression code, where a pathological data     stream may result in the modification of stack data such as frame     pointer, return address or saved registers. A static buffer underflow     was discovered in the pack decompression support, allowing a specially     crafted pack archive to underflow a .bss buffer. A static buffer     overflow was uncovered in the LZH decompression code, allowing a data     stream consisting of pathological huffman codes to overflow a .bss     buffer. Multiple infinite loops were also uncovered in the LZH     decompression code.
  Impact :

    A remote attacker may create a specially crafted gzip archive, which     when decompressed by a user or automated system exectues arbitrary code     with the privileges of the user id invoking gzip. The infinite loops     may be abused by an attacker to disrupt any automated systems invoking     gzip to handle data decompression.
  Workaround :

    There is no known workaround at this time.

来自 Red Hat 安全公告 2006:0667：

更新后的 gzip 程序包修复了多个安全问题，现在可用于 Red Hat Enterprise Linux。

Red Hat 安全响应团队将此更新评级为具有中等安全影响。

gzip 程序包中包含 GNU gzip 数据压缩程序。

Google 安全团队的 Tavis Ormandy 在 gzip 展开存档文件的方式中发现两个拒绝服务缺陷。如果受害者展开特别构建的存档，可导致 gzip 可执行文件挂起或崩溃。（CVE-2006-4334、CVE-2006-4338）

Google 安全团队的 Tavis Ormandy 在 gzip 展开存档文件的方式中发现多个代码执行缺陷。如果受害者展开特别构建的存档，可导致 gzip 可执行文件崩溃或执行任意代码。（CVE-2006-4335、CVE-2006-4336、CVE-2006-4337）

gzip 用户应升级这些更新后的程序包，其中包含向后移植的修补程序，不易受到这些问题的影响。

來自 Red Hat 安全性公告 2006:0667：

現已提供適用於 Red Hat Enterprise Linux 的更新版 gzip 套件，可修正數個安全性問題。

Red Hat 安全性回應團隊已將此更新評等為具有中等安全性影響。

gzip 套件包含 GNU gzip 資料壓縮程式。

Google 安全性團隊的 Tavis Ormandy 在 gzip 展開封存檔案的方式中發現兩個拒絕服務瑕疵。如果受害者展開特製的封存，可導致 gzip 可執行檔懸置或損毀。(CVE-2006-4334、CVE-2006-4338)

Google 安全性團隊的 Tavis Ormandy 在 gzip 展開封存檔案的方式中發現數個程式碼執行瑕疵。如果受害者展開特製的封存，可導致 gzip 可執行檔損毀或執行任意程式碼。(CVE-2006-4335、CVE-2006-4336、CVE-2006-4337)

gzip 使用者應升級至這些更新版套件，其中包含反向移植修補程式，不再受這些問題影響。

Problem Description Multiple programming errors have been found in gzip which can be triggered when gzip is decompressing files. These errors include insufficient bounds checks in buffer use, a NULL pointer dereference, and a potential infinite loop. Impact The insufficient bounds checks in buffer use can cause gzip to crash, and may permit the execution of arbitrary code. The NULL pointer deference can cause gzip to crash. The infinite loop can cause a Denial-of-Service situation where gzip uses all available CPU time.
Workaround No workaround is available.

NULL Dereference (CVE-2006-4334)

A stack modification vulnerability (where a stack buffer can be modified out of bounds, but not in the traditional stack overrun sense) exists in the LZH decompression support of gzip.
(CVE-2006-4335)

A .bss buffer underflow exists in gzip's pack support, where a loop from build_tree() does not enforce any lower bound while constructing the prefix table. (CVE-2006-4336)

A .bss buffer overflow vulnerability exists in gzip's LZH support, due to it's inability to handle exceptional input in the make_table() function, a pathological decoding table can be constructed in such a way as to generate counts so high that the rapid growth of `nextcode` exceeds the size of the table[] buffer. (CVE-2006-4337)

A possible infinite loop exists in code from unlzh.c for traversing the branches of a tree structure. This makes it possible to disrupt the operation of automated systems relying on gzip for data decompression, resulting in a minor DoS. (CVE-2006-4338) Updated packages have been patched to address these issues.

This update fixes several security problems that can be exploited to compromise the system in conjunction with other programs while processing malformated archive files. (CVE-2006-4334 / CVE-2006-4335 / CVE-2006-4336 / CVE-2006-4337 / CVE-2006-4338)

Tavis Ormandy from the Google Security Team discovered several vulnerabilities in gzip, the GNU compression utility. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-4334     A NULL pointer dereference may lead to denial of service     if gzip is used in an automated manner.

  - CVE-2006-4335     Missing boundary checks may lead to stack modification,     allowing execution of arbitrary code.

  - CVE-2006-4336     A buffer underflow in the pack support code may lead to     execution of arbitrary code.

  - CVE-2006-4337     A buffer underflow in the LZH support code may lead to     execution of arbitrary code.

  - CVE-2006-4338     An infinite loop may lead to denial of service if gzip     is used in an automated manner.

Several security issues with gzip have been found that can be exploited to compromise the system in conjunction with other programs while processing malformed archive files. The vulnerabilities have been tracked by Mitre CVE-2006-4334, CVE-2006-4335, CVE-2006-4336, CVE-2006-4337 and CVE-2006-4338.

The remote host is affected by the vulnerability described in GLSA-200611-24 (LHa: Multiple vulnerabilities)

    Tavis Ormandy of the Google Security Team discovered several     vulnerabilities in the LZH decompression component used by LHa. The     make_table function of unlzh.c contains an array index error and a     buffer overflow vulnerability. The build_tree function of unpack.c     contains a buffer underflow vulnerability. Additionally, unlzh.c     contains a code that could run in an infinite loop.
  Impact :

    By enticing a user to uncompress a specially crafted archive, a remote     attacker could cause a Denial of Service by CPU consumption or execute     arbitrary code with the rights of the user running the application.
  Workaround :

    There is no known workaround at this time.

New gzip packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix possible security issues.

Updated gzip packages that fix several security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The gzip package contains the GNU gzip data compression program.

Tavis Ormandy of the Google Security Team discovered two denial of service flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to hang or crash. (CVE-2006-4334, CVE-2006-4338)

Tavis Ormandy of the Google Security Team discovered several code execution flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to crash or execute arbitrary code. (CVE-2006-4335, CVE-2006-4336, CVE-2006-4337)

Users of gzip should upgrade to these updated packages, which contain a backported patch and is not vulnerable to these issues.

From Red Hat Security Advisory 2006:0667 :

Updated gzip packages that fix several security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The gzip package contains the GNU gzip data compression program.

Tavis Ormandy of the Google Security Team discovered two denial of service flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to hang or crash. (CVE-2006-4334, CVE-2006-4338)

Tavis Ormandy of the Google Security Team discovered several code execution flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to crash or execute arbitrary code. (CVE-2006-4335, CVE-2006-4336, CVE-2006-4337)

Users of gzip should upgrade to these updated packages, which contain a backported patch and is not vulnerable to these issues.

Tavis Ormandy discovered that gzip did not sufficiently verify the validity of gzip or compress archives while unpacking. By tricking an user or automated system into unpacking a specially crafted compressed file, this could be exploited to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
67408	Oracle Linux 3 / 4：gzip（ELSA-2006-0667）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
26120	HP-UX PHCO_35587 : HP-UX Running Software Distributor (SD), Remote Denial of Service (DoS) (HPSBUX02195 SSRT061237 rev.1)	Nessus	HP-UX Local Security Checks	2007/9/25	2021/1/11	high
22457	GLSA-200609-13 : gzip: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2006/9/27	2021/1/6	high
67408	Oracle Linux 3 / 4：gzip (ELSA-2006-0667)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
67408	Oracle Linux 3 / 4：gzip (ELSA-2006-0667)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
25437	FreeBSD : gzip -- multiple vulnerabilities (11a84092-8f9f-11db-ab33-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	2007/6/7	2021/1/6	high
24553	Mandrake Linux Security Advisory : gzip (MDKSA-2006:167)	Nessus	Mandriva Local Security Checks	2007/2/18	2021/1/6	high
29458	SuSE 10 Security Update : gzip (ZYPP Patch Number 2085)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	high
22723	Debian DSA-1181-1 : gzip - several vulnerabilities	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	high
41099	SuSE9 Security Update : gzip (YOU Patch Number 11220)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
23746	GLSA-200611-24 : LHa: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2006/11/30	2021/1/6	high
22421	Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : gzip (SSA:2006-262-01)	Nessus	Slackware Local Security Checks	2006/9/22	2021/1/14	high
22422	CentOS 3 / 4 : gzip (CESA-2006:0667)	Nessus	CentOS Local Security Checks	2006/9/22	2021/1/4	high
67408	Oracle Linux 3 / 4 : gzip (ELSA-2006-0667)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
22442	RHEL 2.1 / 3 / 4 : gzip (RHSA-2006:0667)	Nessus	Red Hat Local Security Checks	2006/9/22	2021/1/14	high
27929	Ubuntu 5.04 / 5.10 / 6.06 LTS : gzip vulnerabilities (USN-349-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high