Zlib Security Flaw Could Cause Widespread Trouble

BlueSharpieOfDoom writes "Whitedust has an interesting article posted about the new zlib buffer overflow. It affects countless software applications, even on Microsoft Windows. Some of the most affected application are those that are able to use the PNG graphic format, as zlib is wildely used in compression of PNG images. Zlib was also in the news in 2002 because of a flaw found in the way it handled memory allocation. The new hole could allow remote attackers to crash the vulnerable program or even the possiblity of executing arbitrary code."

Comments

Important: Use a safe browser

[aussie_a]

Because Firefox renders PNG completely, it is prone to these sort of errors. However there is one browser that won't need a patch issued to be safe from this bug, which is Internet Explorer. While IE can render PNG a little, it hasn't implemented the full technology. By using IE, you ensure that you will be safe from any bugs that arise from new technologies, such as PNG.

So next time someone recommends a browser. Stop and wonder about what technology the latest browser has implemented properly without regard to any security issues, and remember that it will be decades before IE implements the technology (if it ever does) so it will be safe for quite some time, by being a stable browser that rarely changes.


Mods: This is not an attempt at troll, but a parody of the typical "This is why you should switch to Firefox" posts whenever a vulnerability involving IE. It should be painfully obvious, but then again most of you are on crack.

Re:Important: Use a safe browser

[ratnerstar]

Were you born without a sense of humor, or did you have it surgically removed?

Re:Modularised code will always have this problem.

[Da Fokka]

For some reason your comment is moderated 'troll', probably because you had the filthy guts of uttering the Forbidden Word 'Visual C++'.

Actually, 'forbidden term' would be more appropriate. My bad.

even on Microsoft Windows

[Turn-X Alphonse]

even on Microsoft Windows

NOT WINDOWS! I was just about to move to it from this Linux thing!

Re:Modularised code will always have this problem.

[CaptainFork]

Why are we still having buffer overflows? There's a compile option in Visual C++ that allows automatic buffer overflow protection. Does GCC have this switch? If so, why not?

If so why not? - and if not, why so?

Why why not but not if not? Why not not?

Re:For those with IE on XP,2003

[smallstepforman]

Opera 8.01 works fine. But what else would you expect from Scandinavians.

Re:Not just IE

[TekBoy]

It is sites like that this that make Firefox's Session Saver extension a bad idea. I just had to click it. :-) Then firefox just had to restore it the next time loaded. :-0

My stupidity squared.

Re:Mods on crack!?

[atrocious cowpat]

Mods: This is not an attempt at troll, but a parody of the typical "This is why you should switch to Firefox" posts whenever a vulnerability involving IE. It should be painfully obvious, but then again most of you are on crack.

Slander! I only mod people down when I'm off crack!

Is i my imagination...

[MSDos-486]

or does it seem the end of the world will be caused by a buffer overflow?

Re:Modularised code will always have this problem.

[Saint Stephen]

Foam at the mouth and fall over backwards. Is he foaming at the mouth to fall over backwards or falling over backwards to foam at the mouth. Tonight 'Spectrum' examines the whole question of frothing and falling, coughing and calling, screaming and bawling, walling and stalling, galling and mauling, palling and hauling, trawling and squalling and zalling. Zalling? Is there a word zalling? If there is what does it mean...if there isn't what does it mean? Perhaps both. Maybe neither. What do I mean by the word mean? What do I mean by the word word, what do I mean by what do I mean, what do I mean by do, and what do I do by mean? What do I do by do by do and what do I do by wasting your time like this? Goodnight

-- Monty Python

Zlib loaded with Spyware

[yajacuk]

I ran the AOL Spyware protection twice this week and both times I found spyware in the Zlib library.
Here is a sample of the Scan log.

ASP Version: 1.0.77 Definition Date: 01-05-05 Date: 7/6/2005 5:02:02 PM
Action: Found: c:\Program Files\daimonin\client\zlib.dll
Spyware Name: Diablo Keys

Re:Modularised code will always have this problem.

[Dun Malg]

Of course, the fact that djb writes secure software using exactly that technique means *you* probably need to rethink your assumptions.

Get a clue, you anonymous turd. DJ Bernstein isn't working under the whip of a corporate master demanding working apps in murderous short timeframes. Furthermore, the existence of one brilliant man who can manage to keep enormous amounts of state in his head and turn out perfect code is not prima facie evidence that all who cannot are somehow lacking.

Personally, my goal is always perfection. I know it's difficult and I don't always achieve it, but I gotta wonder about people like you who "aim low".

Who the fuck said anything about "aiming low"? My point is that errors happen and that you can't just browbeat people into not making mistakes. You say it yourself: "I don't always achieve [perfection]".

Unfortunately, giving people lectures doesn't teach them how to do this.

THAT WAS EXACTLY MY POINT, JACKASS!

In an industry with about zero barrier to entry, most software is going to be crap. Most programmers simply don't know what they are doing. But don't let that cloud your thinking. It *is* possible to write secure software exactly like you describe.

It is possible, but the chaotic way most programming shops are run make it highly unlikely. Overwork, lack of sleep, poor communication, and shifting goals make errors inevitable. One brilliant man sitting down and writing qmail on his own time and at his own pace does not scale to ten overworked regular code grinders trying to crank out two months work in two weeks.

If you think "writing secure software is impossible", you've already lost

If you think that's what I said, go back and read it the fuck again. Your reading comprehension is as bad as your superiority complex.

please get out of the industry, or at least don't write software that deals with network data.

After you, you arrogant prick.