RHSA-2006:0663 - Security Advisory

Topic

Updated ncompress packages that address a security issue and fix bugs are
now available.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

Description

The ncompress package contains file compression and decompression
utilities, which are compatible with the original UNIX compress utility (.Z
file extensions).

Tavis Ormandy of the Google Security Team discovered a lack of bounds
checking in ncompress. An attacker could create a carefully crafted file
that could execute arbitrary code if uncompressed by a victim. (CVE-2006-1168)

In addition, two bugs that affected Red Hat Enterprise Linux 4 ncompress
packages were fixed:

• The display statistics and compression results in verbose mode were not

shown when operating on zero length files.

• An attempt to compress zero length files resulted in an unexpected return

code.

Users of ncompress are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 x86_64
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server 3 i386
• Red Hat Enterprise Linux Server 2 ia64
• Red Hat Enterprise Linux Server 2 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Workstation 2 ia64
• Red Hat Enterprise Linux Workstation 2 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

• BZ - 189215 - ncompress does not display statistics when compressing 0 length files
• BZ - 189216 - Bad return code when compressing 0 length files
• BZ - 201335 - CVE-2006-1168 Possibility to underflow a .bss buffer with attacker controlled data

CVEs

• CVE-2006-1168

References

• http://www.redhat.com/security/updates/classification/#low