CVE-2006-1168

Impact:
Moderate
Public Date:
2006-08-08
Bugzilla:
201919: CVE-2006-1168 ncompress: .bss buffer underflow in decompression

The MITRE CVE dictionary describes this issue as:

The decompress function in compress42.c in (1) ncompress 4.2.4 and (2) liblzw allows remote attackers to cause a denial of service (crash), and possibly execute arbitrary code, via crafted data that leads to a buffer underflow.

Find out more about CVE-2006-1168 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

CVSS v2 metrics

Base Score 5.1
Base Metrics AV:N/AC:H/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity High
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux 6 (busybox) RHSA-2012:0810 2012-06-19
Red Hat Enterprise Linux 2.1 (ncompress) RHSA-2006:0663 2006-09-12
Red Hat Enterprise Linux 5 (busybox) RHSA-2012:0308 2012-02-21
Red Hat Enterprise Linux 3 (ncompress) RHSA-2006:0663 2006-09-12
Red Hat Enterprise Linux 4 (ncompress) RHSA-2006:0663 2006-09-12

Affected Packages State

Platform Package State
Red Hat Enterprise Linux 6 ncompress Not affected
Red Hat Enterprise Linux 5 ncompress Not affected
Red Hat Enterprise Linux 4 busybox Not affected
Unless explicitly stated as not affected, all previous versions of packages in any minor update stream of a product listed here should be assumed vulnerable, although may not have been subject to full analysis.

Acknowledgements

Red Hat would like to thank Tavis Ormandy of the Google Security Team for reporting this issue.
Last Modified

CVE description copyright © 2017, The MITRE Corporation