The error handling in the (1) inflate and (2) inflateBack functions in ZLib compression library 1.2.x allows local users to cause a denial of service (application crash).

New zlib packages are available for Slackware 10.0 and -current to fix a possible denial of service security issue.

Due to a Debian bug report, a Denial of Service vulnerability was discovered in the zlib compression library versions 1.2.x, in the inflate() and inflateBack() functions. Older versions of zlib are not affected.

Once the updated packages have been installed, all programs linked against zlib must be restarted for the new packages to take effect.

The remote host is missing the patch for the advisory SUSE-SA:2004:029 (zlib).


zlib is a widely used data compression library. Programs linked against it include most desktop applications as well as servers such as Apache and OpenSSH.

The 'inflate' function of zlib handles certain input data incorrectly which could lead to a denial of service condition for programs using it with untrusted data. Whether the vulnerability can be exploided locally or remotely depends on the application using it.

zlib versions older than version 1.2 are not affected.

The remote host is affected by the vulnerability described in GLSA-200408-26 (zlib: Denial of service vulnerability)

    zlib contains a bug in the handling of errors in the 'inflate()' and     'inflateBack()' functions.
  Impact :

    An attacker could exploit this vulnerability to launch a Denial of     Service attack on any application using the zlib library.
  Workaround :

    There is no known workaround at this time. All users are encouraged to     upgrade to the latest available version of zlib.

ID	Name	Product	Family	Severity
18745	Slackware 10.0 / current : zlib DoS (SSA:2004-278-02)	Nessus	Slackware Local Security Checks	low
14679	Mandrake Linux Security Advisory : zlib (MDKSA-2004:090)	Nessus	Mandriva Local Security Checks	low
14658	SUSE-SA:2004:029: zlib	Nessus	SuSE Local Security Checks	low
14582	GLSA-200408-26 : zlib: Denial of service vulnerability	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2004-0797

medium

Tenable Plugins

low

low

low

low