[UNIX] Kimgio Input Validation Errors

From: SecuriTeam (support_at_securiteam.com)
Date: 04/25/05

  • Next message: SecuriTeam: "[NT] Adobe ActiveX Allows Local File Discovery" 
    To: list@securiteam.com
Date: 25 Apr 2005 15:18:08 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Kimgio Input Validation Errors
    ------------------------------------------------------------------------

    SUMMARY

    kimgio contains a PCX image file format reader that does not properly
    perform input validation. A source code audit performed by the KDE
    security team discovered several vulnerabilities in the PCX and other
    image file format readers, some of them exploitable to execute arbitrary
    code.

    DETAILS

    Systems affected:
     * kdelibs as shipped with KDE 3.2 up to including KDE 3.4.

    Impact:
    Remotly supplied, specially crafted image files can be used to execute
    arbitrary code.

    Solution:
    Source code patches have been made available which fix these
    vulnerabilities. Contact your OS vendor / binary package provider for
    information about how to obtain updated binary packages.

    Patch:
    A patch for KDE 3.4.0 is available from
    <ftp://ftp.kde.org/pub/kde/security_patches>
    ftp://ftp.kde.org/pub/kde/security_patches :

    78473d4dad612e6617eb6652eec2ab80 post-3.4.0-kdelibs-kimgio.diff

    A patch for KDE 3.3.2 is available from
    <ftp://ftp.kde.org/pub/kde/security_patches>
    ftp://ftp.kde.org/pub/kde/security_patches :

    8366d0e5c8101c315a0bdafac54536d6 post-3.3.2-kdelibs-kimgio.diff

    Time line and credits:
    24/03/2005 Notification of KDE by Bruno Rohee
    21/04/2005 Coordinated Public Disclosure

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1046>
    CAN-2005-1046

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:dirk@kde.org> Dirk Mueller.
    The original article can be found at:
    <http://www.kde.org/info/security/advisory-20050421-1.txt>
    http://www.kde.org/info/security/advisory-20050421-1.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NT] Adobe ActiveX Allows Local File Discovery"

    Relevant Pages

    • [UNIX] Kpdf/Koffice Multiple Buffer Overflows (Xpdf)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... kpdf, the KDE pdf viewer, shares code with xpdf. ... integer overflow vulnerabilities that allow specially crafted PDF files, ... Patch for KDE 3.5.0 is available from ...
      (Securiteam)
    • [UNIX] Cleartext SMB Passwords in Novell Desktop Linux using KDE
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Novell Desktop Linux 9 when using KDE. ... Mike tried performing the same action on Novell ... Keychain) or requested every time the user accesses the network share. ...
      (Securiteam)
    • [UNIX] KDM Vulnerabilities (pam_setcred, session cookie)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Two issues have been discovered in KDM: ... case of error conditions in the installed PAM modules, ... All versions of KDM as distributed with KDE up to and including KDE 3.1.3. ...
      (Securiteam)
    • [UNIX] kpdf Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... kpdf, the KDE pdf viewer, shares code with xpdf. ... Patch for KDE 3.2.3 is available from ...
      (Securiteam)
    • [UNIX] KDM Symlink Attack File Permissions Bypass
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... KDM Symlink Attack File Permissions Bypass ... KDE version 3.2.0 and above ... A patch for KDE 3.3.x is available from ...
      (Securiteam)