Vulnerability Assessment & Network Security Forums



If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important.  If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery.


Home >> Browse Vulnerability Assessment Database >> Red Hat Local Security Checks >> RHSA-2004-536: ncompress


Vulnerability Assessment Details

RHSA-2004-536: ncompress

Vulnerability Assessment Summary
Check for the version of the ncompress packages

Detailed Explanation for this Vulnerability Assessment


An updated ncompress package that fixes a buffer overflow and problem in
the handling of files larger than 2 GB is now available.

The ncompress package contains the compress and uncompress file compression
and decompression utilities, which are compatible with the original UNIX
compress utility (.Z file extensions).

A bug in the way ncompress handles long filenames has been discovered.
ncompress versions 4.2.4 and earlier contain a stack based buffer overflow
when handling very long filenames. It is possible that a possible hacker could
execute arbitrary code on a victims machine by tricking the user into
decompressing a carefully crafted filename. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CVE-2001-1413 to
this issue.

This updated ncompress package also fixes a problem in the handling of
files larger than 2 GB.

All users of ncompress should upgrade to this updated package, which
contains fixes for these issues.




Solution : http://rhn.redhat.com/errata/RHSA-2004-536.html
Network Security Threat Level: High

Networks Security ID:

Vulnerability Assessment Copyright: This script is Copyright (C) 2004 Tenable Network Security

Cables, Connectors

Intel Xeon CPU Eight-Core E5-2690 (2.90GHz, 20M, 8.0GT/s) - SR0L0
$399.99
Intel Xeon CPU Eight-Core E5-2690 (2.90GHz, 20M, 8.0GT/s) - SR0L0 pictureIntel Xeon E5440 Processor(2.83GHz/12M/1333)close to LGA775 Core 2 Quad Q9650
$21.0
Intel Xeon E5440 Processor(2.83GHz/12M/1333)close to LGA775 Core 2 Quad Q9650  pictureDell PowerEdge R710 2x X5670 2.93GHz 6 Core 96GB 6x 146GB 15K SAS PERC 6/i
$905.0
Dell PowerEdge R710 2x X5670 2.93GHz 6 Core 96GB 6x 146GB 15K SAS PERC 6/i pictureDell PowerEdge M630 Blade 2x E5-2630Lv3 64GB DDR4 2x 900GB 10K SAS H730, 57810-k
$2955.0
Dell PowerEdge M630 Blade 2x E5-2630Lv3 64GB DDR4 2x 900GB 10K SAS H730, 57810-k picture


Discussions

No Discussions have been posted on this vulnerability.