Buffer underflow in the build_tree function in unpack.c in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code via a crafted leaf count table that causes a write to a negative index.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - multiple vulnerabilities in lha (CVE-2006-4336, CVE-2006-4337)

  - Array index error in the make_table function in unlzh.c in the LZH decompression component in gzip 1.3.5,     when running on certain platforms, allows context-dependent attackers to cause a denial of service (crash)     and possibly execute arbitrary code via a crafted GZIP archive that triggers an out-of-bounds write, aka a     stack modification vulnerability. (CVE-2006-4335)

  - lharc.c in lha does not securely create temporary files, which might allow local users to read or write     files by creating a file before LHA is invoked. (CVE-2007-2030)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

From Red Hat Security Advisory 2006:0667 :

Updated gzip packages that fix several security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The gzip package contains the GNU gzip data compression program.

Tavis Ormandy of the Google Security Team discovered two denial of service flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to hang or crash. (CVE-2006-4334, CVE-2006-4338)

Tavis Ormandy of the Google Security Team discovered several code execution flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to crash or execute arbitrary code. (CVE-2006-4335, CVE-2006-4336, CVE-2006-4337)

Users of gzip should upgrade to these updated packages, which contain a backported patch and is not vulnerable to these issues.

Several security issues with gzip have been found that can be exploited to compromise the system in conjunction with other programs while processing malformed archive files. The vulnerabilities have been tracked by Mitre CVE-2006-4334, CVE-2006-4335, CVE-2006-4336, CVE-2006-4337 and CVE-2006-4338.

This update fixes several security problems that can be exploited to compromise the system in conjunction with other programs while processing malformated archive files. (CVE-2006-4334 / CVE-2006-4335 / CVE-2006-4336 / CVE-2006-4337 / CVE-2006-4338)

Tavis Ormandy discovered that gzip did not sufficiently verify the validity of gzip or compress archives while unpacking. By tricking an user or automated system into unpacking a specially crafted compressed file, this could be exploited to execute arbitrary code with the user's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes several security problems that can be exploited to compromise the system in conjunction with other programs while processing malformated archive files.
(CVE-2006-4334,CVE-2006-4335,CVE-2006-4336,CVE-2006-4337,CVE

-2006-4338)

s700_800 11.11 Software Distributor Cumulative Patch : 

A potential security vulnerability has been identified with the version of GZIP delivered by HP-UX Software Distributor (SD). The vulnerability could be remotely exploited leading to a Denial of Service (DoS).

Problem Description Multiple programming errors have been found in gzip which can be triggered when gzip is decompressing files. These errors include insufficient bounds checks in buffer use, a NULL pointer dereference, and a potential infinite loop. Impact The insufficient bounds checks in buffer use can cause gzip to crash, and may permit the execution of arbitrary code. The NULL pointer deference can cause gzip to crash. The infinite loop can cause a Denial-of-Service situation where gzip uses all available CPU time.
Workaround No workaround is available.

NULL Dereference (CVE-2006-4334)

A stack modification vulnerability (where a stack buffer can be modified out of bounds, but not in the traditional stack overrun sense) exists in the LZH decompression support of gzip.
(CVE-2006-4335)

A .bss buffer underflow exists in gzip's pack support, where a loop from build_tree() does not enforce any lower bound while constructing the prefix table. (CVE-2006-4336)

A .bss buffer overflow vulnerability exists in gzip's LZH support, due to it's inability to handle exceptional input in the make_table() function, a pathological decoding table can be constructed in such a way as to generate counts so high that the rapid growth of `nextcode` exceeds the size of the table[] buffer. (CVE-2006-4337)

A possible infinite loop exists in code from unlzh.c for traversing the branches of a tree structure. This makes it possible to disrupt the operation of automated systems relying on gzip for data decompression, resulting in a minor DoS. (CVE-2006-4338) Updated packages have been patched to address these issues.

The remote host is affected by the vulnerability described in GLSA-200611-24 (LHa: Multiple vulnerabilities)

    Tavis Ormandy of the Google Security Team discovered several     vulnerabilities in the LZH decompression component used by LHa. The     make_table function of unlzh.c contains an array index error and a     buffer overflow vulnerability. The build_tree function of unpack.c     contains a buffer underflow vulnerability. Additionally, unlzh.c     contains a code that could run in an infinite loop.
  Impact :

    By enticing a user to uncompress a specially crafted archive, a remote     attacker could cause a Denial of Service by CPU consumption or execute     arbitrary code with the rights of the user running the application.
  Workaround :

    There is no known workaround at this time.

Tavis Ormandy from the Google Security Team discovered several vulnerabilities in gzip, the GNU compression utility. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-4334     A NULL pointer dereference may lead to denial of service     if gzip is used in an automated manner.

  - CVE-2006-4335     Missing boundary checks may lead to stack modification,     allowing execution of arbitrary code.

  - CVE-2006-4336     A buffer underflow in the pack support code may lead to     execution of arbitrary code.

  - CVE-2006-4337     A buffer underflow in the LZH support code may lead to     execution of arbitrary code.

  - CVE-2006-4338     An infinite loop may lead to denial of service if gzip     is used in an automated manner.

The remote host is affected by the vulnerability described in GLSA-200609-13 (gzip: Multiple vulnerabilities)

    Tavis Ormandy of the Google Security Team has reported multiple     vulnerabilities in gzip. A stack buffer modification vulnerability was     discovered in the LZH decompression code, where a pathological data     stream may result in the modification of stack data such as frame     pointer, return address or saved registers. A static buffer underflow     was discovered in the pack decompression support, allowing a specially     crafted pack archive to underflow a .bss buffer. A static buffer     overflow was uncovered in the LZH decompression code, allowing a data     stream consisting of pathological huffman codes to overflow a .bss     buffer. Multiple infinite loops were also uncovered in the LZH     decompression code.
  Impact :

    A remote attacker may create a specially crafted gzip archive, which     when decompressed by a user or automated system exectues arbitrary code     with the privileges of the user id invoking gzip. The infinite loops     may be abused by an attacker to disrupt any automated systems invoking     gzip to handle data decompression.
  Workaround :

    There is no known workaround at this time.

Updated gzip packages that fix several security issues are now available for Red Hat Enterprise Linux.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The gzip package contains the GNU gzip data compression program.

Tavis Ormandy of the Google Security Team discovered two denial of service flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to hang or crash. (CVE-2006-4334, CVE-2006-4338)

Tavis Ormandy of the Google Security Team discovered several code execution flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to crash or execute arbitrary code. (CVE-2006-4335, CVE-2006-4336, CVE-2006-4337)

Users of gzip should upgrade to these updated packages, which contain a backported patch and is not vulnerable to these issues.

New gzip packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix possible security issues.

ID	Name	Product	Family	Severity
198443	RHEL 4 : lha (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
67408	Oracle Linux 3 / 4 : gzip (ELSA-2006-0667)	Nessus	Oracle Linux Local Security Checks	high
41099	SuSE9 Security Update : gzip (YOU Patch Number 11220)	Nessus	SuSE Local Security Checks	high
29458	SuSE 10 Security Update : gzip (ZYPP Patch Number 2085)	Nessus	SuSE Local Security Checks	high
27929	Ubuntu 5.04 / 5.10 / 6.06 LTS : gzip vulnerabilities (USN-349-1)	Nessus	Ubuntu Local Security Checks	high
27261	openSUSE 10 Security Update : gzip (gzip-2084)	Nessus	SuSE Local Security Checks	high
26120	HP-UX PHCO_35587 : HP-UX Running Software Distributor (SD), Remote Denial of Service (DoS) (HPSBUX02195 SSRT061237 rev.1)	Nessus	HP-UX Local Security Checks	high
25437	FreeBSD : gzip -- multiple vulnerabilities (11a84092-8f9f-11db-ab33-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	high
24553	Mandrake Linux Security Advisory : gzip (MDKSA-2006:167)	Nessus	Mandriva Local Security Checks	high
23746	GLSA-200611-24 : LHa: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
22723	Debian DSA-1181-1 : gzip - several vulnerabilities	Nessus	Debian Local Security Checks	high
22457	GLSA-200609-13 : gzip: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
22442	RHEL 2.1 / 3 / 4 : gzip (RHSA-2006:0667)	Nessus	Red Hat Local Security Checks	high
22422	CentOS 3 / 4 : gzip (CESA-2006:0667)	Nessus	CentOS Local Security Checks	high
22421	Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : gzip (SSA:2006-262-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2006-4336

critical

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high