Subject: Re: NetBSD Security Advisory 2003-004: Format string vulnerability in zlib gzprintf()
To: Paul Hoffman <phoffman@proper.com>
From: David Maxwell <david@vex.net>
List: tech-security
Date: 03/26/2003 21:39:11
On Wed, Mar 26, 2003 at 02:58:37PM -0800, Paul Hoffman wrote:
> At 1:54 PM -0500 3/26/03, NetBSD Security Officer wrote:
> >* NetBSD 1.6:
> >. . .
> >
> > Alternatively, apply the following patch (with potential offset
> > differences):
> >
> > ftp://ftp.netbsd.org/pub/NetBSD/security/patches/SA2003-004-zlib-1.6.patch
>
> That works.
>
> >
> > To patch, re-build and re-install zlib:
> >
> > # cd src/lib/libz
> > # patch < /path/to/SA2003-004-zlib-1.6.patch
>
> That doesn't. The patch wants gzio.c, but it doesn't exist in the directory:
> . . .
> -rw-r--r-- 1 root wheel 16110 Mar 11 2002 example.c
> -rw-r--r-- 1 root wheel 2186 Oct 26 1999 gzio_compat.c
> -rw-r--r-- 1 root wheel 12502 Mar 11 2002 infblock.c
> . . .
That's very odd. How did you get that particular set of sources? I'd be
curious, since your set seems incomplete.
gzio.c was included in the src at the time of the 1.6 release (in fact,
it has been in the same place since before NetBSD 1.3...) and was at
revision 1.12 at the time of the 1.6 release.
You can see the same here:
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libz/gzio.c
One simple method - use this link:
http://cvsweb.netbsd.org/bsdweb.cgi/~checkout~/src/lib/libz/gzio.c?rev=1.12.2.1&content-type=text/plain
That will download the gzio.c file, including the patch (you can see from
the patch header that it turns 1.12 into 1.12.2.1 - the link above will
give you a complete 1.12.2.1
--
David Maxwell, david@vex.net|david@maxwell.net -->
(About an Amiga rendering landscapes) It's not thinking, it's being artistic!
- Jamie Woods