From: "Stefan Kanthak" <stefan.kanthak@nexgo.de.>
To: <bugtraq@securityfocus.com.>
Subject: Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096)
Date: Thu, 18 Oct 2007 21:05:43 +0200
Organization: Me, myself & I
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 5.50.4980.1600
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4980.1600
X-Virus-Scanned: ClamAV 0.91.2/4545/Wed Oct 17 23:05:57 2007 on mail-in-07.arcor-online.net
X-Virus-Status: Clean
X-Virus-Scanned: antivirus-gw at tyumen.ru
The Windows binary GSV48W32.EXE of "gsview"
<http://pages.cs.wisc.edu/~ghost/gsview/>;
<ftp://mirror.cs.wisc.edu/pub/mirrors/ghost/ghostgum/gsv48w32.exe>;
ships with a zlib32.dll (originally named zlib.dll) v1.2.2
<http://www.zlib.net/>; which is vulnerable to CAN-2005-2096.
The zlib32.dll is dated 2005-03-06 (GSview 4.8 was release 2005-03-26),
i.e. before CAN-2005-2096 was published, so its very likely that all
the binaries provided by the author will show a vulnerable zlib if they
contain one.
A scan with ClamAV against the patterns published by Florian Weimer
at <http://www.enyo.de/fw/security/zlib-fingerprint/>; verifies the
presence of the patterns of the vulnerable code:
| x:\>clamscan --database CAN-2005-2096.db
| ZLIB32.DLL: CAN-2005-2096.zlib-1.2.2 FOUND
|
| ----------- SCAN SUMMARY -----------
| Known viruses: 16
| Engine version: 0.91.2
| Scanned directories: 1
| Scanned files: 1
Stefan Kanthak
