bugtraq - Official Windows binaries of "curl" contain vulnerable zlib 1.2.2 (CAN-2005-2096)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 18 Oct 2007 21:05:56 +0200
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: <bugtraq@...urityfocus.com>
Subject: Official Windows binaries of "curl" contain vulnerable zlib 1.2.2 (CAN-2005-2096)

The Windows binaries of "curl", built by the author and maintainer of
curl and available for download at <http://curl.haxx.se/download.html>
are linked with zlib 1.2.2 <http://www.zlib.net/>, which is but
vulnerable to CAN-2005-2096:

| x:\>curl -V
| curl 7.17.0 (i586-pc-mingw32msvc) libcurl/7.17.0 zlib/1.2.2
| Protocols: tftp ftp telnet dict ldap http file
| Features: Largefile NTLM SSPI libz

A scan with ClamAV against the patterns published by Florian Weimer
at <http://www.enyo.de/fw/security/zlib-fingerprint/> verifies the
presence of the patterns of the vulnerable code:

| x:\>clamscan --database CAN-2005-2096.db
| CURL.EXE: CAN-2005-2096.zlib-1.2.2 FOUND
|
| ----------- SCAN SUMMARY -----------
| Known viruses: 16
| Engine version: 0.91.2
| Scanned directories: 1
| Scanned files: 1

Stefan Kanthak