FreeBSD-SA-05:18.zlib "Buffer overflow in zlib"

! security

The FreeBSD Project よりセキュリティ勧告が出ました。要点を以下にまとめます。

  • 未稿

セキュリティ勧告は ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:18.zlib.asc にあります。
以下は上記のセキュリティ勧告の一部とその訳文です。ただし品質は保証致しません。

I. 背景 - Background

zlib is a compression library used by numerous applications to provide data compression/decompression routines.

II. 問題の詳細 - Problem Description

A fixed-size buffer is used in the decompression of data streams. Due to erronous analysis performed when zlib was written, this buffer, which was belived to be sufficiently large to handle any possible input stream, is in fact too small.

III. 影響範囲 - Impact

A carefully constructed compressed data stream can result in zlib overwriting some data structures. This may cause applications to halt, resulting in a denial of service; or it may result in an attacker gaining elevated privileges.

IV. 回避方法 - Workaround

No workaround is available.

><