National Cyber-Alert System

Vulnerability Summary for CVE-2008-1372

Overview

bzlib.c in bzip2 before 1.0.5 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted file that triggers a buffer over-read, as demonstrated by the PROTOS GENOME test suite for Archive Formats.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (10/17/2008)

Red Hat has re-evaluated the potential impact of this flaw and has released an update which corrects this behavior: http://rhn.redhat.com/errata/RHSA-2008-0893.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA09-218A

Name: TA09-218A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA09-218A.html

US-CERT Vulnerability Note: VU#813451

Name: VU#813451

Hyperlink:http://www.kb.cert.org/vuls/id/813451

External Source: FEDORA

Name: FEDORA-2008-3037

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00225.html

External Source: FEDORA

Name: FEDORA-2008-2970

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00165.html

External Source: CONFIRM

Name: https://bugs.gentoo.org/attachment.cgi?id=146488&action=view

Hyperlink:https://bugs.gentoo.org/attachment.cgi?id=146488&action=view

External Source: XF

Name: bzip2-archives-code-execution(41249)

Hyperlink:http://xforce.iss.net/xforce/xfdb/41249

External Source: VUPEN

Name: ADV-2009-2172

Hyperlink:http://www.vupen.com/english/advisories/2009/2172

External Source: UBUNTU

Name: USN-590-1

Hyperlink:http://www.ubuntulinux.org/support/documentation/usn/usn-590-1

External Source: SLACKWARE

Name: SSA:2008-098-02

Hyperlink:http://www.slackware.org/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.473263

External Source: SECTRACK

Name: 1020867

Hyperlink:http://www.securitytracker.com/id?1020867

External Source: BID

Name: 28286

Hyperlink:http://www.securityfocus.com/bid/28286

External Source: BUGTRAQ

Name: 20081203 VMSA-2008-0019 VMware Hosted products and patches for ESX and ESXi resolve a critical security issue and update bzip2

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/498863/100/0/threaded

External Source: BUGTRAQ

Name: 20080321 rPSA-2008-0118-1 bzip2

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/489968/100/0/threaded

External Source: REDHAT

Name: RHSA-2008:0893

Hyperlink:http://www.redhat.com/support/errata/RHSA-2008-0893.html

External Source: MANDRIVA

Name: MDVSA-2008:075

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:075

External Source: CONFIRM

Name: http://www.ipcop.org/index.php?name=News&file=article&sid=40

Hyperlink:http://www.ipcop.org/index.php?name=News&file=article&sid=40

External Source: GENTOO

Name: GLSA-200804-02

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200804-02.xml

External Source: VUPEN

Name: ADV-2008-2557

Hyperlink:http://www.frsirt.com/english/advisories/2008/2557

External Source: VUPEN

Name: ADV-2008-0915

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2008/0915

External Source: MISC

Name: http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/

Hyperlink:http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/

External Source: MISC

Name: http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html

Hyperlink:http://www.cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html

External Source: CONFIRM

Name: http://www.bzip.org/CHANGES

Hyperlink:http://www.bzip.org/CHANGES

External Source: CONFIRM

Name: http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0118

Hyperlink:http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0118

External Source: CONFIRM

Name: http://support.apple.com/kb/HT3757

Hyperlink:http://support.apple.com/kb/HT3757

External Source: SUNALERT

Name: 241786

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-241786-1

External Source: GENTOO

Name: GLSA-200903-40

Hyperlink:http://security.gentoo.org/glsa/glsa-200903-40.xml

External Source: SECUNIA

Name: 36096

Hyperlink:http://secunia.com/advisories/36096

External Source: SECUNIA

Name: 31878

Hyperlink:http://secunia.com/advisories/31878

External Source: SECUNIA

Name: 31869

Hyperlink:http://secunia.com/advisories/31869

External Source: SECUNIA

Name: 31204

Hyperlink:http://secunia.com/advisories/31204

External Source: SECUNIA

Name: 29940

Hyperlink:http://secunia.com/advisories/29940

External Source: SECUNIA

Name: 29698

Hyperlink:http://secunia.com/advisories/29698

External Source: SECUNIA

Name: 29677

Hyperlink:http://secunia.com/advisories/29677

External Source: SECUNIA

Name: 29656

Hyperlink:http://secunia.com/advisories/29656

External Source: SECUNIA

Name: 29506

Hyperlink:http://secunia.com/advisories/29506

External Source: SECUNIA

Name: 29497

Hyperlink:http://secunia.com/advisories/29497

External Source: SECUNIA

Name: 29475

Hyperlink:http://secunia.com/advisories/29475

External Source: SECUNIA

Name: 29410

Hyperlink:http://secunia.com/advisories/29410

External Source: SUSE

Name: SUSE-SR:2008:011

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html

External Source: APPLE

Name: APPLE-SA-2009-08-05-1

Hyperlink:http://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html

External Source: CONFIRM

Name: http://kb.vmware.com/kb/1007504

Hyperlink:http://kb.vmware.com/kb/1007504

External Source: CONFIRM

Name: http://kb.vmware.com/kb/1007198

Hyperlink:http://kb.vmware.com/kb/1007198

External Source: CONFIRM

Name: http://kb.vmware.com/kb/1006982

Hyperlink:http://kb.vmware.com/kb/1006982

External Source: NETBSD

Name: NetBSD-SA2008-004

Hyperlink:ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2008-004.txt.asc