Zlib压缩库解压拒绝服务漏洞

发布日期：2005-07-21
更新日期：2005-07-29

受影响系统：

zlib zlib 1.2.2
zlib zlib 1.2.1

不受影响系统：

zlib zlib 1.2.3

描述：

---

BUGTRAQ ID: 14340
CVE(CAN) ID: CVE-2005-1849

zlib是很多应用程序都在使用的压缩库，可提供数据压缩/解压例程。

Zlib中存在拒绝服务漏洞，攻击者可能利用此漏洞进行拒绝服务攻击。

起因是函数库没有正确的处理解压例程的意外输入。由于错误的指定了解压时所使用的某些值，在打开无效的文件时可能导致函数库崩溃。

<*来源：Markus Oberhumer

链接：http://www.debian.org/security/2005/dsa-763
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:18.zlib.asc
http://security.gentoo.org/glsa/glsa-200507-19.xml
http://lwn.net/Alerts/144583/?format=printable
*>

建议：

---

厂商补丁：

Debian
------
Debian已经为此发布了一个安全公告（DSA-763-1）以及相应补丁:
DSA-763-1：New zlib packages fix buffer overflow
链接：http://www.debian.org/security/2005/dsa-763

补丁下载：

Source archives:

http://security.debian.org/pool/updates/main/z/zlib/zlib_1.2.2.orig.tar.gz
Size/MD5 checksum: 430700 d43dabe3d374e299f2631c5fc5ce31f5
http://security.debian.org/pool/updates/main/z/zlib/zlib_1.2.2-4.sarge.2.dsc
Size/MD5 checksum: 807 e3fa0febf789e5c758d43476199825fd
http://security.debian.org/pool/updates/main/z/zlib/zlib_1.2.2-4.sarge.2.diff.gz
Size/MD5 checksum: 14718 e733bcc48ade3c675bc62a2554e2a453

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_alpha.deb
Size/MD5 checksum: 533980 950f2426191fd20fa1a0a1d975c5285d
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_alpha.udeb
Size/MD5 checksum: 57220 1d97d651c5fb317b435ca4b4e03df7f0
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_alpha.deb
Size/MD5 checksum: 82078 804c8d3a9b53373fa8693ea4b5db059e
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_alpha.deb
Size/MD5 checksum: 30566 128b7f15f363185d05471bdd99fd4039

arm architecture (ARM)

http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_arm.udeb
Size/MD5 checksum: 42196 cec7d515976e1269116df86d58976ef1
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_arm.deb
Size/MD5 checksum: 498234 80358e0e95f2be93600919065d31515c
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_arm.deb
Size/MD5 checksum: 66728 0f055650a3092f0782bd00e10c78a64d
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_arm.deb
Size/MD5 checksum: 25286 6a7931194287cc37f44f3a050ca1e945

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_hppa.deb
Size/MD5 checksum: 70420 cb03981137f73dd2fb9a2a2cc40f2d18
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_hppa.udeb
Size/MD5 checksum: 45430 7344c8007baae367ba7c8c4c72cfda68
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_hppa.deb
Size/MD5 checksum: 512584 920721beba8dd6edc1c476b83bba74a0
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_hppa.deb
Size/MD5 checksum: 29308 bd0d18dbaf6e9edaabcbce52528cc195

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_i386.udeb
Size/MD5 checksum: 38402 764ca5f9b9f9fa58c776678225ea8a4b
http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_i386.deb
Size/MD5 checksum: 63080 f1d25909fcc26fb653ff92083e3c6b1c
http://security.debian.org/pool/updates/main/z/zlib/zlib-bin_1.2.2-4.sarge.2_i386.deb
Size/MD5 checksum: 25780 857be9a5220d54c222ded9c4faff6a22
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_i386.deb
Size/MD5 checksum: 488024 dd74347cf85d778238ada4e5b42f8642

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/z/zlib/zlib1g_1.2.2-4.sarge.2_ia64.deb
Size/MD5 checksum: 93462 6ed01ecbd1f214aa7fee259285944ea7
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-dev_1.2.2-4.sarge.2_ia64.deb
Size/MD5 checksum: 553666 a54eb90a0ac7ffef0460aed3d7f558c7
http://security.debian.org/pool/updates/main/z/zlib/zlib1g-udeb_1.2.2-4.sarge.2_ia64.udeb
Size/MD5 checksum: 68610 56f859f0d990f5b9869dc999c3d0230d

文章整理：西部数码--专业提供域名注册、虚拟主机服务
http://www.west263.com
以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!