Re: Windows binary of "GSview 4.8" contain vulnerable zlib (CAN-2005-2096)

Anonymous <farion42@yahoo.de> wrote Saturday, October 20, 2007 11:55 AM:

> As a workaround, one could try to manually replace zlib32.dll in a Windows
> GSView 4.8 installation with the current zlib1.dll version 1.2.3.
>
> "Applications linking statically with or using their own copy of zlib 1.1.3
> or earlier must be recompiled to avoid the security problem described here.
> Otherwise it is sufficient to upgrade the shared zlib library then restart
> all applications using it."[1]
>
> [1] http://www.zlib.net/apps.html

http://www.zlib.net/DLL_FAQ.txt (according to the HTTP response last
modified on Sunday, 24 Oct 2004 20:53:16 GMT) states that zlib1.dll 1.2.x
is linked against MSVCRT.DLL.

The vulnerable ZLIB32.DLL distributed with GSview 4.8 is but not linked
against MSVCRT.DLL. Although its version/copyright strings equal the ones
of the "official" zlib1.dll from zlib.net, I'm not sure who built the
ZLIB32.DLL in question. It doesn't completely look like the "official"
zlib1.dll.

Unfortunately the maintainer of GSview choose not to reply to my bug
report which included a question about the source of the ZLIB32.DLL.

As long as I cant be sure that the replacement zlib1.dll from zlib.net
is fully compatible to the ZLIB32.DLL distributed with GSview 4.8 I wont
give any advice to exchange it.

BTW: replacement of ZLIB32.DLL wont close all the vulnerabilities in
GSview 4.8. The maintainer was informed about some more (trivial to spot)
vulnerabilities together with the here published one.

Stefan Kanthak

BTW: your "reply" is missing a "References:" (or "In-Reply-To:") header!