CVE-2006-1168: High severity ncompress ncompress vulnerability
Report from Tavis Ormandy, Google Security Team:
An audit of ncompress version 4.2.4 uncovered a serious security flaw, this loop in decompress() (~1749, compress42.c) performs no bounds checking, allowing a specially crafted datastream to underflow a .bss buffer with attacker controlled data. Some research reveals that the lzw decompressors from gzip and openbsd (both derived from the same public domain implementation) have already corrected this flaw, however ncompress shipped by (at least) gentoo, debian, fedora and suse seem to still be vulnerable.
while ((cmpcodeint)code >= (cmpcodeint)256) { / Generate output characters in reverse order / --stackp = tabsuffixof(code); code = tabprefixof(code); }
In my test environment I've been able to successfully overwirte .got and .dtors with controlled data. The most simple testcase would be:
$ perl -e 'print "\x1f\x9d\x90","\x01"x"2048"' | compress -d
My suggested fix would be adding && stackp >= htabof(0) to the loop condition.
Other sources
The decompress function in compress42.c in (1) ncompress 4.2.4 and (2) liblzw allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code, via crafted data that leads to a buffer underflow.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2006-1168?
CVE-2006-1168 is classified as a critical vulnerability due to its potential for buffer underflow, which could be exploited to execute arbitrary code.
How do I fix CVE-2006-1168?
To mitigate CVE-2006-1168, update ncompress to version 0:4.2.4-39.rhel3 or higher for Red Hat Enterprise Linux 3, or the equivalent versions for other affected distributions.
What software is affected by CVE-2006-1168?
CVE-2006-1168 affects ncompress version 4.2.4 and specific versions of busybox as outlined in various Red Hat distributions.
What type of vulnerability is CVE-2006-1168?
CVE-2006-1168 is a buffer underflow vulnerability that occurs due to insufficient bounds checking in the decompress function.
Is CVE-2006-1168 still relevant today?
Although CVE-2006-1168 was reported in 2006, it remains relevant for systems still utilizing vulnerable versions of ncompress or busybox.