[NEWS] Multiple Vendor GIMP Multiple Integer Overflow Vulnerabilities
- From: SecuriTeam <support@xxxxxxxxxxxxxx>
- Date: 10 Jul 2007 10:42:03 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
Multiple Vendor GIMP Multiple Integer Overflow Vulnerabilities
The GNU Image Manipulation Program is "commonly known as the GIMP. It is a
freely distributed piece of software for such tasks as photo retouching,
image composition and image authoring. It is available, in many languages,
for multiple operating systems". Remote exploitation of multiple integer
overflow vulnerabilities in several of the image loader plug-ins included
with distributions of 'The GIMP' allow attackers to crash The GIMP or
potentially execute arbitrary code with the privileges of the user.
* GIMP version 2.2.15
* GIMP version 2.2.16
The following lines show the location of some vulnerabilities within the
code responsible for loading the DICOM, PNM, PSD, PSP, Sun RAS, XBM, and
XWD file formats. Each of the files are located within the plug-ins/common
directory of the source code.
dicom.c:391: value = g_new0 (guint8, element_length + 4);
pnm.c:566: data = g_new (guchar, gimp_tile_height () * info->xres *
pnm.c:628: data = g_new (guchar, gimp_tile_height () * info->xres *
pnm.c:681: data = g_new (guchar, gimp_tile_height () * info->xres);
psd.c:2969: PSDheader.rowlength = g_malloc (PSDheader.rows *
psp.c:1225: pixel = g_malloc0 (height * width * bytespp);
sunras.c:955: data = g_malloc (tile_height * width);
sunras.c:1076: data = g_malloc (tile_height * width);
sunras.c:1146: data = g_malloc (tile_height * width * 3);
sunras.c:1231: data = g_malloc (tile_height * width * 3);
xbm.c:879: data = (guchar *) g_malloc (width * tileheight);
xwd.c:1193: data = g_malloc (tile_height * width);
xwd.c:1195: scanline = g_new (guchar, xwdhdr->l_bytes_per_line + 8);
xwd.c:1352: data = g_malloc (tile_height * width);
xwd.c:1441: data = g_malloc (tile_height * width * 3);
xwd.c:1601: data = g_malloc (tile_height * width * 3);
xwd.c:1812: data = g_malloc (tile_height * width * bytes_per_pixel);
In each case, an integer value from an untrusted input source has
arithmetic operations performed upon it to calculate the length to
allocate. Since no integer overflow checking is performed, a potentially
exploitable heap overflow may result.
This is not a complete list of integer overflow vulnerabilities in the
Exploitation allows attackers to execute arbitrary code in the context of
the user opening a malicious image file.
In order to be successful, the attacker must convince the victim into
opening a maliciously crafted image with The GIMP.
Consider moving the affected loader modules from The GIMP's plug-in
directory to another location. The location in the file system may vary
depending on distributions. On Red Hat Linux and Debian systems the
default plug-in directory is /usr/lib/gimp/2.0/plug-ins.
The GIMP maintainers have released version 2.2.16 to address these
vulnerabilities. For more information, consult the following URL:
08/17/2006 - Initial vendor notification
10/06/2006 - Second vendor notification
06/26/2007 - Third vendor notification
06/26/2007 - Initial vendor response
07/09/2007 - Coordinated public disclosure
The information has been provided by Sean Larsson (iDefense Labs).
The original article can be found at:
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.
- Prev by Date: [NEWS] SAP Message Server Heap Overflow
- Next by Date: [EXPL] WinPcap NPF.SYS Privilege Elevation Vulnerability (PoC exploit)
- Previous by thread: [NEWS] SAP Message Server Heap Overflow
- Next by thread: [EXPL] WinPcap NPF.SYS Privilege Elevation Vulnerability (PoC exploit)