REDHAT-BUG-727624
First published: Tue Aug 02 2011(Updated: )
BSD compress implemented an LZW compressor and decompressor. This decompressor implementation did not correctly handle compressed streams that contain code words that were not yet added to the decompression table. LZW decompression has a special case (a KwKwK string) when code word may match the first free entry in the decompression table. The implementation used in BSD compress allow code words not only matching, but also exceeding the first free entry. It seems this compress implementation first appeared in BSD around 1985, and was later used in various other code base, such as ncompress and gzip. Other components that contain affected code will be listed below. Following page list the version of the code as was used in 4.3BSD: <a href="http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/usr.bin/compress/compress.c">http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/usr.bin/compress/compress.c</a> Relevant code appears in the decompress() routine: /* * Special case for KwKwK string. */ if ( code >= free_ent ) { *stackp++ = finchar; code = oldcode; } This allows creating a loop in the decompression table, which leads to an "infinite" loop: /* * Generate output characters in reverse order */ #ifdef SIGNED_COMPARE_SLOW while ( ((unsigned long)code) >= ((unsigned long)256) ) { #else while ( code >= 256 ) { #endif *stackp++ = tab_suffixof(code); code = tab_prefixof(code); } where tab_prefixof is: unsigned short codetab [HSIZE]; #define codetabof(i) codetab[i] #define tab_prefixof(i) codetabof(i) This overflows de_stack "buffer" (part of the htab[]): count_int htab [HSIZE]; # define tab_suffixof(i) ((char_type *)(htab))[i] # define de_stack ((char_type *)&tab_suffixof(1<<BITS)) Depending on the relative htab[] and codetab[] positions, de_stack overflow may overwrite codetab[] entries, which may break infinite loop and let program continue its execution with possibly corrupted memory.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| BSD compress | >=1985 | |
| BSD compress | ||
| gzip | ||
| SUSE Ncompress |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/usr.bin/compress/compress.c
- http://ncompress.git.sourceforge.net/git/gitweb.cgi?p=ncompress/ncompress;a=blob;f=compress.c;h=c16e1239#l1167
- http://git.savannah.gnu.org/gitweb/?p=gzip.git;a=blob;f=unlzw.c;h=63f941c6#l297
- http://code.google.com/p/libarchive/source/browse/trunk/libarchive/archive_read_support_filter_compress.c?r=3195#375
- http://git.busybox.net/busybox/tree/archival/libarchive/decompress_uncompress.c?id=833d4e7f#n220
- http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/compress/zopen.c#rev1.17
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/log/src/lzw/zopen.c
- http://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/src/lzw/zopen.c?id=a1c990a6#n251
- http://cgit.freedesktop.org/xorg/lib/libXfont/tree/src/fontfile/decompress.c?id=f29f1d68#n249
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=725760
- http://nail.cvs.sourceforge.net/viewvc/nail/nail/lzw.c?revision=1.4&view=markup#l511
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=516375
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=516375&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=727624#c1
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=727624#c5
- https://access.redhat.com/security/cve/CVE-2006-1168
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=201919
- http://lists.freedesktop.org/archives/xorg-announce/2011-August/001721.html
- http://lists.freedesktop.org/archives/xorg-announce/2011-August/001722.html
- http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=d11ee5886e9d9ec610051a206b135a4cdc1e09a0
- https://rhn.redhat.com/errata/RHSA-2011-1154.html
- https://rhn.redhat.com/errata/RHSA-2011-1155.html
- https://rhn.redhat.com/errata/RHSA-2011-1161.html
- https://rhn.redhat.com/errata/RHSA-2011-1834.html
- https://bugzilla.redhat.com/show_bug.cgi?id=727624
Frequently Asked Questions
What is the severity of REDHAT-BUG-727624?
The severity of REDHAT-BUG-727624 is considered to be critical due to the potential for arbitrary code execution.
How do I fix REDHAT-BUG-727624?
To fix REDHAT-BUG-727624, update to the patched versions of BSD compress, GNU gzip, or any affected software as provided by the vendor.
Which software is affected by REDHAT-BUG-727624?
The software affected by REDHAT-BUG-727624 includes BSD compress, GNU gzip, and ncompress.
What type of vulnerability is REDHAT-BUG-727624?
REDHAT-BUG-727624 is a vulnerability in the LZW decompression implementation that can lead to denial of service or arbitrary code execution.
Is REDHAT-BUG-727624 likely to be exploited in the wild?
Yes, REDHAT-BUG-727624 could be exploited in the wild due to its critical nature and the common usage of the affected software.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-2895
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/bsd
- canonical/bsd compress
- vendor/gnu
- canonical/gzip
- vendor/unknown
- canonical/suse ncompress