CVE Name:       CAN-2005-1849

For general information regarding FreeBSD Security Advisories,
including descriptions of the fields above, security branches, and the
following sections, please visit
<URL:http://www.freebsd.org/security/>.

NOTE WELL: The issue discussed in this advisory is distinct from the
issue discussed in the earlier advisory FreeBSD-SA-05:16.zlib, although
the impact is very similar.

I.   Background

zlib is a compression library used by numerous applications to provide
data compression/decompression routines.

II.  Problem Description

A fixed-size buffer is used in the decompression of data streams.  Due
to erronous analysis performed when zlib was written, this buffer,
which was belived to be sufficiently large to handle any possible input
stream, is in fact too small.

III. Impact

A carefully constructed compressed data stream can result in zlib
overwriting some data structures.  This may cause applications to halt,
resulting in a denial of service; or it may result in an attacker
gaining elevated privileges.

IV.  Workaround

No workaround is available.

V.   Solution

Perform one of the following:

1) Upgrade your vulnerable system to 5-STABLE, or to the RELENG_5_4 or
RELENG_5_3 security branch dated after the correction date.

2) To patch your present system:

The following patches have been verified to apply to FreeBSD 5.3, and 5.4
systems.

a) Download the relevant patch from the location below, and verify the
detached PGP signature using your PGP utility.

# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:18/zlib.patch
# fetch ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/patches/SA-05:18/zlib.patch.asc

b) Execute the following commands as root:

# cd /usr/src
# patch < /path/to/patch
# cd /usr/src/lib/libz/
# make obj && make depend && make && make install

VI.  Correction details

The following list contains the revision numbers of each file that was
corrected in FreeBSD.

Branch                                                                                                    
                         Path                                                                            Revision
--------------------------------------------------------------------------------------------------------

--------------------------------------------------------------------------------------------------------

VII. References

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1849