Bug 19529 - zlib new security issues found by mozilla security audit (CVE-2016-984[0-3])
Summary: zlib new security issues found by mozilla security audit (CVE-2016-984[0-3])
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL: https://lwn.net/Vulnerabilities/709847/
Whiteboard: MGA5-32-OK MGA5-64-OK advisory
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2016-10-04 15:25 CEST by David Walser
Modified: 2016-12-22 00:41 CET (History)
6 users (show)

See Also:
Source RPM: zlib-1.2.8-7.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2016-10-04 15:25:28 CEST
Mozilla has published the results of a security audit of zlib:
https://wiki.mozilla.org/images/0/09/Zlib-report.pdf

Links to the fixes are in this document:
https://docs.google.com/document/d/10i1KZS5so8xDqH2rplRa2xet0tyTvvJlLbQQmZIUIKE/edit

Patched packages uploaded for Mageia 5 and Cauldron.

Advisory to come later.

Updated packages in core/updates_testing:
========================
libzlib1-1.2.8-7.1.mga5
libzlib-devel-1.2.8-7.1.mga5
libminizip1-1.2.8-7.1.mga5
libminizip-devel-1.2.8-7.1.mga5

from zlib-1.2.8-7.1.mga5.src.rpm
Comment 1 Lewis Smith 2016-10-11 21:36:20 CEST
I cannot find any reference to other softawre using this library:
 # urpmq --whatrequires libzlib1
 libzlib-devel
 libzlib1

There is a man page for 'zlib' (but no command). However,
 # urpmq --whatrequires zlib
 No package called zlib

Can we test this update? Is it used by Firefox?

CC: (none) => lewyssmith

Comment 2 Len Lawrence 2016-10-11 21:54:36 CEST
@lewis
Strange.  I tried that command:
$ urpmq --whatrequires lib64zlib1
and it returned 873 package names.  It looked like practically everything used it, from stellarium to firefox, ruby and vlc.
I tried running some commands under strace and examined the output for signs of zlib and could see nothing.  Maybe the library is used only under certain circumstances.

CC: (none) => tarazed25

Comment 3 Len Lawrence 2016-10-11 22:16:40 CEST
Try installing the minizip stuff.
$ urpmq --whatrequires lib64minizip1 | sort | uniq
chromium-browser-stable
fceux
lib64assimp3
lib64cegui0_2
lib64minizip1
lib64minizip-devel
sigil
spring
springlobby
vcmi

$ urpmq --requires-recursive vcmi
turns up lib64zlib1, amongst other things.

Don't know if there are any executable commands amongst that lot.
Comment 4 Len Lawrence 2016-10-11 22:30:43 CEST
sigil is for editing epub files and others are to do with game consoles and engines, apart from Chromium.  For vcmi you need to install Heroes III. !!!
Comment 5 Len Lawrence 2016-10-11 22:45:29 CEST
Looking back to comment 2...
gthumb is an image viewer which displays thumbnails of the images below the main frame.  It seems likely that zlib would come into play there but I could not see anything in an strace.

However:
$ cat trace | grep libz
open("/lib64/libz.so.1", O_RDONLY|O_CLOEXEC) = 3
open("/usr/lib64/libz.so.1.2.8", O_RDONLY) = 3
open("/usr/lib64/libz.so.1.2.8", O_RDONLY) = 9
Comment 6 Herman Viaene 2016-10-15 11:42:26 CEST
MGA5-32 on Acer D620 Xfce
No installation issues
Looked at list generated by "urpmq --whatrequires libzlib1" and decided to go for
strace -o /home/tester5/Documenten/fsarch.txt qt4-fsarchiver" and backed up a partition (about 3Gb)
Backup ran successfully and  fsarch.txt (14.7Mb) shows three calls to libz.so.1

CC: (none) => herman.viaene
Whiteboard: (none) => MGA5-32-OK

Comment 7 Mike Rambo 2016-10-18 22:23:33 CEST
MGA5 x86_64 on hardware (Acer Veriton M4618G)

Used Herman's basic procedure but with nmap.

Update's from testing installed fine.
[mrambo@rambobox ~]$ rpm -qa | grep zlib
lib64zlib-devel-1.2.8-7.1.mga5
lib64zlib1-1.2.8-7.1.mga5

[root@rambobox mrambo]# strace -o zlib_test.txt nmapfe

[mrambo@rambobox ~]$ grep libz zlib_test.txt
open("/lib64/libz.so.1", O_RDONLY|O_CLOEXEC) = 6
open("/usr/lib64/libz.so.1.2.8", O_RDONLY) = 6

Several successful calls to libz.so.1. Looks good on x86_64.

CC: (none) => mrambo
Whiteboard: MGA5-32-OK => MGA5-32-OK MGA5-64-OK

Comment 8 Lewis Smith 2016-10-19 12:44:21 CEST
(In reply to David Walser from comment #0)
> Advisory to come later.
If you can, David, please do (I will create/upload it). TIA

Thanks to Herman & Mike for your tests. Update validated, advisory pending.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 9 David Walser 2016-10-19 14:53:12 CEST
From reading the original document again, it doesn't sound like any of these bugs present as security issues currently, but hypothetically could in the future.  Changing this to a bug fix update.

Advisory:
----------------------------------------

The zlib package has been patched to fix four issues where the code relies on
undefined behavior in the C standard, which could have negative interactions
with certain compiler optimizations or future compiler behavior.

References:
https://wiki.mozilla.org/images/0/09/Zlib-report.pdf

Component: Security => RPM Packages
QA Contact: security => (none)

Nicolas Lécureuil 2016-10-19 17:30:45 CEST

CC: (none) => mageia
Whiteboard: MGA5-32-OK MGA5-64-OK => MGA5-32-OK MGA5-64-OK advirosy

Nicolas Lécureuil 2016-10-19 17:30:55 CEST

Whiteboard: MGA5-32-OK MGA5-64-OK advirosy => MGA5-32-OK MGA5-64-OK advisory

Comment 10 Mageia Robot 2016-10-19 17:35:36 CEST
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGAA-2016-0128.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 11 David Walser 2016-12-05 20:10:57 CET
CVE request:
http://openwall.com/lists/oss-security/2016/12/05/10
Comment 12 David Walser 2016-12-06 00:38:54 CET
CVE-2016-984[0-3] assigned for the last two issues in the audit report:
http://www.openwall.com/lists/oss-security/2016/12/05/21

Summary: zlib new security issues found by mozilla security audit => zlib new security issues found by mozilla security audit (CVE-2016-984[0-3])

David Walser 2016-12-22 00:41:54 CET

URL: (none) => https://lwn.net/Vulnerabilities/709847/


Note You need to log in before you can comment on or make changes to this bug.