CVE-2009-2624: Input Validation
A missing input sanitation flaw was found in the way gzip used to decompress data blocks for dynamic Huffman codes. A remote attacker could provide a specially-crafted gzip compressed data archive, which once opened by a local, unsuspecting user would lead to denial of service (gzip crash) or, potentially, to arbitrary code execution with the privileges of the user running gzip.
Upstream patch: --------------- http://git.savannah.gnu.org/cgit/gzip.git/commit/?id=39a362ae9d9b007473381dba5032f4dfc1744cf2
CVE Note: --------- This flaw reportedly exists due to re-introduction of CVE-2006-4334 issue:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4334
in upstream gzip version (originally fixed in gzip-v1.3.6, reintroduced later in gzip-v1.3.10 and fixed again with above commit -- in gzip-v.1.3.13).
Credit: ------- Oulu University Secure Programming Group (OUSPG)
Other sources
The huftbuild function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive. NOTE: this issue is caused by a CVE-2006-4334 regression.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2624?
CVE-2009-2624 is categorized as a denial of service vulnerability due to a missing input sanitation flaw in gzip.
How do I fix CVE-2009-2624?
To fix CVE-2009-2624, upgrade to the latest version of gzip that addresses the vulnerability.
Which versions of gzip are affected by CVE-2009-2624?
Versions 1.3.1 to 1.3.12 of GNU gzip are affected by CVE-2009-2624.
What are the risks of not addressing CVE-2009-2624?
Not addressing CVE-2009-2624 may leave systems vulnerable to denial of service attacks leading to crashes.
How can I check if my system is vulnerable to CVE-2009-2624?
You can check if your system is vulnerable to CVE-2009-2624 by verifying the version of gzip installed on your system.