possible memory leak in zlib compression

2008.07.12
Credit: Dustin Kirkland
Risk: Medium
Local: No
Remote: Yes
CVE: CVE-2008-1678
CWE: CWE-399


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: None
Availability impact: Partial

I'm trying to solve a reproducible memory leak that manifests itself with SSL + Apache2: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/224945 Valgrind, plus our own research, points to a possible memory leak in crypto/comp/c_zlib.c in libssl0.9.8g. We see: struct zlib_state *state = -> (struct zlib_state *)OPENSSL_malloc(sizeof(struct zlib_state)); allocating the data. However, it does not seem that a zlib_stateful_free_ex_data() is called to free it. Thanks, :-Dustin Dustin Kirkland Ubuntu Server Developer Canonical, LTD GPG: 1024D/83A61194 ______________________________________________________________________ OpenSSL Project http://www.openssl.org Development Mailing List openssl-dev@openssl.org Automated List Manager majordomo@openssl.org

References:

https://issues.apache.org/bugzilla/show_bug.cgi?id=44975
https://bugs.edge.launchpad.net/bugs/224945
https://bugs.edge.launchpad.net/bugs/186339
http://svn.apache.org/viewvc?view=rev&revision=654119
http://security.gentoo.org/glsa/glsa-200807-06.xml
http://secunia.com/advisories/31026
http://marc.info/?l=openssl-dev&m=121060672602371&w=2
http://bugs.gentoo.org/show_bug.cgi?id=222643


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top