TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ----------------------------------------------------------------------------
Brian, RealSecure does indeed employ zlib for extracting X-Press Update information. Fortunately, ISS uses strong and proven cryptographic algorithms to apply a digital signature to all ISS binaries including XPU packages. This signature is used to authenticate and verify that all binaries are from ISS, and that they have not been tampered with. Before any X-Press Update is applied, this digital signature is validated. Such validation takes place before calling the zlib library. This ensures that only ISS certified files are extracted during the XPU process, making it unlikely that someone would be able to exploit this zlib vulnerability through RealSecure. Having said this, we will update the version of zlib we use in the next major version of the sensor which is due out in the near future. Also, note that as far as I've been able to tell, no other ISS product relies specifically on zlib to extract data. --Jordan ============================= Jordan Blake - [EMAIL PROTECTED] Product Manager Network Protection Solutions Internet Security Systems - The Power to Protect ============================= -----Original Message----- From: Sommers,Brian [mailto:[EMAIL PROTECTED]] Sent: Monday, March 18, 2002 4:37 PM To: [EMAIL PROTECTED] Subject: Zlib in RealSecure TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ---------------------------------------------------------------------------- I was running a scan on a system to see what programs were using zlib, because of the recent zlib security vulnerability. Using the "find-zlib" perl script from http://www.gzip.org/zlib/apps.html I noticed the following: /opt/ISS/issDaemon/issDaemon: inflate version: "1.1.3 Copyright 1995-1998 Mark Adler" /opt/ISS/issDaemon/issDaemon: zlib cplens table, big endian /opt/ISS/issDaemon/issDaemon: zlib cplext table (version 1.0.5 to 1.1.4) So it appears that the issDaemon from RealSecure network sensor (v6.0) has zlib 1.1.3 built in, unless I am mistaken. Brian
