The decompression algorithm in zlib 1.1.3 and earlier, as used in many different utilities and packages, causes inflateEnd to release certain memory more than once (a "double free"), which may allow local and remote attackers to execute arbitrary code via a block of malformed compression data.

The compression library zlib has a flaw in which it attempts to free memory more than once under certain conditions. This can possibly be exploited to run arbitrary code in a program that includes zlib. If a network application running as root is linked to zlib, this could potentially lead to a remote root compromise. No exploits are known at this time. This vulnerability is assigned the CVE candidate name of CAN-2002-0059.

The zlib vulnerability is fixed in the Debian zlib package version 1.1.3-5.1. A number of programs either link statically to zlib or include a private copy of zlib code. These programs must also be upgraded to eliminate the zlib vulnerability. The affected packages and fixed versions follow :

  - amaya 2.4-1potato1
  - dictd 1.4.9-9potato1

  - erlang 49.1-10.1

  - freeamp 2.0.6-2.1

  - mirrordir 0.10.48-2.1

  - ppp 2.3.11-1.5

  - rsync 2.3.2-1.6

  - vrweb 1.5-5.1

Those using the pre-release (testing) version of Debian should upgrade to zlib 1.1.3-19.1 or a later version. Note that since this version of Debian has not yet been released it may not be available immediately for all architectures. Debian 2.2 (potato) is the latest supported release.


We recommend that you upgrade your packages immediately. Note that you should restart all programs that use the shared zlib library in order for the fix to take effect. This is most easily done by rebooting the system.

Ethan Benson discovered a bug in rsync where the supplementary groups that the rsync daemon runs as (such as root) would not be removed from the server process after changing to the specified unprivileged uid and gid. This seems only serious if rsync is called using 'rsync
--daemon' from the command line where it will inherit the group of the user starting the server (usually root). Note that, by default, Mandrake Linux uses xinetd to handle connections to the rsync daemon.
This was fixed upstream in version 2.5.3, as well as the previously noted zlib fixes (see MDKSA-2002:023). The authors released 2.5.4 with some additional zlib fixes, and all users are encouraged to upgrade to this new version of rsync.

Matthias Clasen found a security issue in zlib that, when provided with certain input, causes zlib to free an area of memory twice. This 'double free' bug can be used to crash any programs that take untrusted compressed input, such as web browsers, email clients, image viewing software, etc. This vulnerability can be used to perform Denial of Service attacks and, quite possibly, the execution of arbitrary code on the affected system.

MandrakeSoft has published two advisories concerning this incident :

MDKSA-2002:022 - zlib MDKSA-2002:023 - packages containing zlib

Update :

Additional package are now available. For a list of prior packages released, please see MDKSA-2002:023. The noted packages below are in addition to MDKSA-2002:023; no packages have been replaced.

Matthias Clasen found a security issue in zlib that, when provided with certain input, causes zlib to free an area of memory twice. This 'double free' bug can be used to crash any programs that take untrusted compressed input, such as web browsers, email clients, image viewing software, etc. This vulnerability can be used to perform Denial of Service attacks and, quite possibly, the execution of arbitrary code on the affected system.

MandrakeSoft has published two advisories concerning this incident :

MDKSA-2002:022 - zlib MDKSA-2002:023 - packages containing zlib

The second advisory contains additional packages that bring their own copies of the zlib source, and as such need to be fixed and rebuilt.
Updating the zlib library is sufficient to protect those programs that use the system zlib, but the packages as noted in MDKSA-2002:023 will need to be updated for those packages that do not use the system zlib.

ID	Name	Product	Family	Severity
14959	Debian DSA-122-1 : zlib - malloc error (double free)	Nessus	Debian Local Security Checks	high
13932	Mandrake Linux Security Advisory : rsync (MDKSA-2002:024)	Nessus	Mandriva Local Security Checks	high
13931	Mandrake Linux Security Advisory : zlib-pkgs (MDKSA-2002:023-1)	Nessus	Mandriva Local Security Checks	high
13930	Mandrake Linux Security Advisory : zlib (MDKSA-2002:022)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2002-0059

critical

Tenable Plugins

high

high

high

high