-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________

			SCO Security Advisory

Subject:		OpenServer 5.0.6 OpenServer 5.0.7 OpenServer 6.0.0 : Zlib Multiple Vulnerabilities
Advisory number:	SCOSA-2006.6
Issue date:		2006 January 10
Cross reference:	sr894696 fz532828 erg712900 sr894695 fz532829 erg712899
			CVE-2004-0797 CVE-2005-1849 CVE-2005-2096
______________________________________________________________________________


1. Problem Description

	The error handling in the (1) inflate and (2) inflateBack
	functions in ZLib compression library 1.2.x allows local users
	to cause a denial of service (application crash).
	
	The Common Vulnerabilities and Exposures project (cve.mitre.org)
	has assigned the name CVE-2004-0797 to this issue.
	
	inftrees.h in zlib 1.2.2 allows remote attackers to cause a
	denial of service (application crash) via an invalid file that
	causes a large dynamic tree to be produced.
	
	The Common Vulnerabilities and Exposures project (cve.mitre.org)
	has assigned the name CVE-2005-1849 to this issue.
	
	Buffer overflow in zlib 1.2 and later versions allows remote
	attackers to cause a denial of service (crash) via a crafted
	compressed stream, as demonstrated using a crafted PNG file.
	
	The Common Vulnerabilities and Exposures project (cve.mitre.org)
	has assigned the name CVE-2005-2096 to this issue.


2. Vulnerable Supported Versions

	System				Binaries
	----------------------------------------------------------------------
	OpenServer 5.0.6 		/usr/lib/libz.so.1
	OpenServer 5.0.7 		/usr/lib/libz.so.1
	OpenServer 6.0.0 		/usr/lib/libz.so.1
					/osr5/usr/lib/libz.so.1


3. Solution

	The proper solution is to install the latest packages.


4. OpenServer 5.0.6

	4.1 Location of Fixed Binaries

	ftp://ftp.sco.com/pub/openserver5/opensrc/gwxlibs-2.1.0Ba/


	4.2 Verification

	MD5 (gwxlibs210Ba_vol.tar) = 18213632bd0c5ff1e260eac90aae7033

	md5 is available for download from
		ftp://ftp.sco.com/pub/security/tools


	4.3 Installing Fixed Binaries

	Please see the following:

	ftp://ftp.sco.com/pub/openserver5/opensrc/gwxlibs-2.1.0Ba/gwxlibs-2.1.0Ba.txt

5. OpenServer 5.0.7

	5.1 Location of Fixed Binaries

	ftp://ftp.sco.com/pub/openserver5/507/mp/osr507mp4/osr507mp4_vol.tar


	5.2 Verification

	MD5 (osr507mp4_vol.tar) = 4c87d840ff5b43221258547d19030228

	md5 is available for download from
		ftp://ftp.sco.com/pub/security/tools


	5.3 Installing Fixed Binaries

	Please see the SCO OpenServer Release 5.0.7 Maintenance Pack 4 Release
	and Installation Notes:

	ftp://ftp.sco.com/pub/openserver5/507/mp/osr507mp4/osr507mp4.htm


6. OpenServer 6.0.0

	6.1 Location of Fixed Binaries

	ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.6


	6.2 Verification

	MD5 (VOL.000.000) = b077f94a0d35829500695abb703aa408

	md5 is available for download from
		ftp://ftp.sco.com/pub/security/tools


	6.3 Installing Fixed Binaries

	Upgrade the affected binaries with the following sequence:

	1) Download the VOL* files to a directory.

	2) Run the custom command, specify an install from media images,
	   and specify the directory as the location of the images.


7. References

	Specific references for this advisory:
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0797
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1849
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2096
		http://www.kb.cert.org/vuls/id/238678
		http://www.kb.cert.org/vuls/id/680620

	SCO security resources:
		http://www.sco.com/support/security/index.html

	SCO security advisories via email
		http://www.sco.com/support/forums/security.html

	This security fix closes SCO incidents sr894696 fz532828
	erg712900 sr894695 fz532829 erg712899.


8. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers
	intended to promote secure installation and use of SCO
	products.


9. Acknowledgments

	The SCO Group would like to thank Mark Adler for his research.

______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (UnixWare)

iD8DBQFDw+9HaqoBO7ipriERArTPAJ4k35+HA+yFMlVS6rYZeBAVBncrBQCfXGcm
OV1CEV0lnjNu5Aj1hoD8+uk=
=adQN
-----END PGP SIGNATURE-----