bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats.

The remote BIG-IP device is missing a patch required by a security advisory.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2008-0893 advisory.

    [1.0.3-4]
    - Resolves: #461587       fix cash on malformed archive file - CVE-2008-1372         (apply upstream patch)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A buffer over-read flaw was discovered in the bzip2 decompression routine. This issue could cause an application linked against the libbz2 library to crash when decompressing malformed archives.
(CVE-2008-1372)

Specially crafted files could crash the bzip2-decoder. (CVE-2008-1372)

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.8.  Mac OS X 10.5.8 contains security fixes for the following products : 

  - bzip2
  - CFNetwork
  - ColorSync
  - CoreTypes
  - Dock
  - Image RAW
  - ImageIO
  - Kernel
  - launched
  - Login Window
  - MobileMe
  - Networking
  - XQuery

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.8. 

Mac OS X 10.5.8 contains security fixes for the following products :

  - bzip2
  - CFNetwork
  - ColorSync
  - CoreTypes
  - Dock
  - Image RAW
  - ImageIO
  - Kernel
  - launchd
  - Login Window
  - MobileMe
  - Networking
  - XQuery

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2009-003 applied.

This security update contains fixes for the following products :

  - bzip2
  - ColorSync
  - ImageIO
  - Login Window

a. Critical Memory corruption vulnerability

   A memory corruption condition may occur in the virtual machine    hardware. A malicious request sent from the guest operating    system to the virtual hardware may cause the virtual hardware to    write to uncontrolled physical memory.

   VMware would like to thank Andrew Honig of the Department of    Defense for reporting this issue.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-4917 to this issue.

b. Updated Service Console package bzip2

   bzip2 versions before 1.0.5 can crash if certain flaws in compressed    data lead to reading beyond the end of a buffer.  This might cause    an application linked to the libbz2 library to crash when    decompressing malformed archives.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-1372 to this issue.

Bzip2 versions before 1.0.5 are vulnerable to a denial of service attack via malicious compressed data.

The updated packages have been patched to prevent the issue.

The remote host is affected by the vulnerability described in GLSA-200903-40 (Analog: Denial of Service)

    Diego E. Petteno reported that the Analog package in Gentoo is built     with its own copy of bzip2, making it vulnerable to CVE-2008-1372 (GLSA     200804-02).
  Impact :

    A local attacker could place specially crafted log files into a log     directory being analyzed by analog, e.g. /var/log/apache, resulting in     a crash when being processed by the application.
  Workaround :

    There is no known workaround at this time.

Updated bzip2 packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Bzip2 is a freely available, high-quality data compressor. It provides both stand-alone compression and decompression utilities, as well as a shared library for use with other programs.

A buffer over-read flaw was discovered in the bzip2 decompression routine. This issue could cause an application linked against the libbz2 library to crash when decompressing malformed archives.
(CVE-2008-1372)

Users of bzip2 should upgrade to these updated packages, which contain a backported patch to resolve this issue.

Specially crafted files could crash the bzip2-decoder (CVE-2008-1372).

This update fixes bzip2 denial of service (crash) on malformed archives - CVE-2008-1372, #438118.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New bzip2 packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix a DoS issue.

The remote host is affected by the vulnerability described in GLSA-200804-02 (bzip2: Denial of Service)

    The Oulu University discovered that bzip2 does not properly check     offsets provided by the bzip2 file, leading to a buffer overread.
  Impact :

    Remote attackers can entice a user or automated system to open a     specially crafted file that triggers a buffer overread, causing a     Denial of Service. libbz2 and programs linking against it are also     affected.
  Workaround :

    There is no known workaround at this time.

It was discovered that bzip2 did not correctly handle certain malformed archives. If a user or automated system were tricked into processing a specially crafted bzip2 archive, applications linked against libbz2 could be made to crash, possibly leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SecurityFocus reports :

The 'bzip2' application is prone to a remote file-handling vulnerability because the application fails to properly handle malformed files.

Exploit attempts likely result in application crashes.

ID	Name	Product	Family	Severity
78227	F5 Networks BIG-IP : bzip2 vulnerability (SOL9592)	Nessus	F5 Networks Local Security Checks	medium
67750	Oracle Linux 5 : bzip2 (ELSA-2008-0893)	Nessus	Oracle Linux Local Security Checks	medium
60474	Scientific Linux Security Update : bzip2 on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41482	SuSE 10 Security Update : Linux kernel (ZYPP Patch Number 5295)	Nessus	SuSE Local Security Checks	medium
41204	SuSE9 Security Update : bzip2 (YOU Patch Number 12119)	Nessus	SuSE Local Security Checks	medium
5122	Mac OS X 10.5 < 10.5.8 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
40502	Mac OS X 10.5.x < 10.5.8 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
40501	Mac OS X Multiple Vulnerabilities (Security Update 2009-003)	Nessus	MacOS X Local Security Checks	critical
40386	VMSA-2008-0019 : VMware Hosted products and patches for ESX and ESXi resolve a critical security issue and update bzip2	Nessus	VMware ESX Local Security Checks	high
37613	Mandriva Linux Security Advisory : bzip2 (MDVSA-2008:075)	Nessus	Mandriva Local Security Checks	medium
36048	GLSA-200903-40 : Analog: Denial of Service	Nessus	Gentoo Local Security Checks	medium
34229	RHEL 2.1 / 3 / 4 / 5 : bzip2 (RHSA-2008:0893)	Nessus	Red Hat Local Security Checks	medium
34222	CentOS 3 / 4 / 5 : bzip2 (CESA-2008:0893)	Nessus	CentOS Local Security Checks	medium
32212	SuSE 10 Security Update : bzip2 (ZYPP Patch Number 5114)	Nessus	SuSE Local Security Checks	medium
32211	openSUSE 10 Security Update : bzip2 (bzip2-5112)	Nessus	SuSE Local Security Checks	medium
31828	Fedora 7 : bzip2-1.0.4-11.fc7 (2008-3037)	Nessus	Fedora Local Security Checks	medium
31820	Fedora 8 : bzip2-1.0.4-13.fc8 (2008-2970)	Nessus	Fedora Local Security Checks	medium
31803	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 8.1 / 9.0 / 9.1 / current : bzip2 (SSA:2008-098-02)	Nessus	Slackware Local Security Checks	medium
31753	GLSA-200804-02 : bzip2: Denial of Service	Nessus	Gentoo Local Security Checks	medium
31677	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : bzip2 vulnerability (USN-590-1)	Nessus	Ubuntu Local Security Checks	medium
31633	FreeBSD : bzip2 -- crash with certain malformed archive files (063399fc-f6d6-11dc-bcee-001c2514716c)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2008-1372

medium

Tenable Plugins

medium

medium

medium

medium

medium

critical

critical

critical

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium