Detections
Analytics

RHEL 2.1 : zlib (RHSA-2003:081)

high Nessus Plugin ID 12374

Synopsis

The remote Red Hat host is missing one or more security updates.

Description

Updated zlib packages that fix a buffer overflow vulnerability are now available.

Zlib is a general-purpose, patent-free, lossless data compression library that is used by many different programs.

The function gzprintf within zlib, when called with a string longer than Z_PRINTF_BUFZISE (= 4096 bytes), can overflow without giving a warning.

zlib-1.1.4 and earlier exhibit this behavior. There are no known exploits of the gzprintf overrun, and only a few programs, including rpm2html and gimp-print, are known to use the gzprintf function.

The problem has been fixed by checking the length of the output string within gzprintf.

Solution

Update the affected zlib and / or zlib-devel packages.

See Also

https://access.redhat.com/security/cve/cve-2003-0107

https://access.redhat.com/errata/RHSA-2003:081

Plugin Details

Severity: High

ID: 12374

File Name: redhat-RHSA-2003-081.nasl

Version: 1.24

Type: local

Agent: unix

Published: 7/6/2004

Updated: 1/14/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:zlib, p-cpe:/a:redhat:enterprise_linux:zlib-devel, cpe:/o:redhat:enterprise_linux:2.1

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 5/22/2003

Vulnerability Publication Date: 3/7/2003

Reference Information

CVE: CVE-2003-0107

RHSA: 2003:081