[UNIX] Multiple Vendor xzgv PRF Parsing Integer Overflow Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 12/15/04

  • Next message: SecuriTeam: "[NT] Microsoft Word 6.0/95 Document Converter Buffer Overflow (MS04-041)" 
    To: list@securiteam.com
Date: 15 Dec 2004 19:35:07 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Multiple Vendor xzgv PRF Parsing Integer Overflow Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    xzgv is "a picture viewer for X, with a thumbnail-based file selector. It
    uses GTK+ and Imlib 1.x. Most file formats are supported, and the
    thumbnails used are compatible with xv, zgv and the Gimp".

    Remote exploitation of an integer overflow vulnerability in various
    vendors' implementations of the read_prf_file method in the xzgv program
    could allow for arbitrary code execution. The vulnerability specifically
    exists due to an integer overflow while allocating memory for an image
    file.

    DETAILS

    The vulnerable code is as follows:
    xzgv-0.8/src/readprf.c:
    if((*theimageptr=malloc(width*height*3))==NULL)
    [...]

    The values width and height are integers that are ultimately supplied by
    the image file. With certain values for height and width set in an image
    file, not enough memory is allocated due to an integer overflow. The under
    allocated memory is later written to, causing heap corruption and possible
    arbitrary code execution with the privileges of the user viewing the image
    file.

    Analysis:
    Exploitation allows attackers to gain the privileges of the user viewing
    the image file. If a user can be convinced to view a malicious file, this
    vulnerability can be exploited remotely.

    Detection:
    The following vendors have confirmed the availability of susceptible xzgv
    packages within their respective operating system distributions:
            SuSE
            Debian
            Gentoo
            FreeBSD

    Workaround:
    Only accept image files from trusted sources. Use a different image viewer
    program to view untrusted images.

    Vendor Response:
    The vulnerability has been addressed in the following patch:
    <http://rus.members.beeb.net/xzgv-0.8-integer-overflow-fix.diff>
    http://rus.members.beeb.net/xzgv-0.8-integer-overflow-fix.diff

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0994>
    CAN-2004-0994.

    Disclosure Timeline:
    11/05/2004 - Initial vendor notification
    12/10/2004 - Secondary vendor notification
    12/10/2004 - Initial vendor response
    12/13/2004 - Coordinated public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:idlabs-advisories@idefense.com> iDEFENSE.
    The original article can be found at:
    <http://www.idefense.com/application/poi/display?id=160&type=vulnerabilities&flashstatus=false> http://www.idefense.com/application/poi/display?id=160&type=vulnerabilities&flashstatus=false

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Microsoft Word 6.0/95 Document Converter Buffer Overflow (MS04-041)"

    Relevant Pages

    • [UNIX] Multiple Vendor ImageMagick Sign Extension Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Vendor ImageMagick Sign Extension Vulnerability ...
      (Securiteam)
    • [NT] ICQ 6 Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... ICQ 6 Buffer Overflow Vulnerability ... Vendor status: ...
      (Securiteam)
    • [NT] Microsoft Publisher Font Parsing Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Publisher Font Parsing Vulnerability ... 12/08/2005 - Vulnerability confirmed by Vendor. ...
      (Securiteam)
    • [UNIX] Multiple Vendor ImageMagick Off-By-One Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Multiple Vendor ImageMagick Off-By-One Vulnerability ...
      (Securiteam)
    • [NT] w3wp DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... 1/12/2006 - Vendor requested for additional info ... recv(conn_socket, szBuffer, 256, 0); ...
      (Securiteam)