[VIM] zoo - amavis - barracuda cross-ref problems

[security curmudgeon]

On Wed, 25 Jul 2007, Steven M. Christey wrote:

Whee, time to dig up the past!

Clearing my mailbox, I revisted this and noticed:

: CVE didn't pick up SA25315, and we didn't independently notice the 
: AMaViS advisory, which is why it wasn't mentioned.  The phrasing for 
: 2007-1669 definitely could have been better, instead of emphasizing 
: Barracuda so much.  I've changed both CVEs to mention AMaViS 
: specifically.
: 
: Note that the AMaViS advisory implies that the problem only occurs when 
: AMaViS is installed on a system that already independently has the 
: vulnerable ZOO software.  So, this isn't necessarily a case of borrowed 
: code appearing in AMaViS, rather a defense-in-depth measure like when 
: Mozilla recently defended itself against the IE argument injection 
: issue.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2007-1669

zoo decoder 2.10 (zoo-2.10), as used in multiple products including (1) 
Barracuda Spam Firewall 3.4 and later with virusdef before 2.0.6399, (2) 
Spam Firewall before 3.4 20070319 with virusdef before 2.0.6399o, and (3) 
AMaViS 2.4.1 and earlier, allows remote attackers to cause a denial of 
service (infinite loop) via a ZOO archive with a direntry structure that 
points to a previous file.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2007-1673

unzoo.c, as used in multiple products including AMaViS 2.4.1 and earlier, 
allows remote attackers to cause a denial of service (infinite loop) via a 
ZOO archive with a direntry structure that points to a previous file.

--

Appears that these now overlap and are likely duplicates, where 1673 shows 
a little more detail (unzoo.c), and 1669 has a better affected product 
list.