imlib2 BMP image buffer overflow
| imlib2-bmp-bo (17183) |  High Risk |
Description:
imlib2 is vulnerable to a buffer overflow. By creating a specially-crafted BMP image file containing runlength-encoded images, a remote attacker could overflow a buffer and cause the program to crash or possibly execute arbitrary code on the system, once the victim decodes the malicious file.
Platforms Affected:
- Conectiva, Linux 10
- Conectiva, Linux 9.0
- Debian, Debian Linux 3.0
- Enlightenment, imlib2 1.1.1 and prior
- Gentoo, Linux
- MandrakeSoft, Mandrake Linux 10.0
- MandrakeSoft, Mandrake Linux 10.0 AMD64
- MandrakeSoft, Mandrake Linux 9.2 AMD64
- MandrakeSoft, Mandrake Linux 9.2
- MandrakeSoft, Mandrake Linux Corporate Server 2.1 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 2.1
- Sun, JDS 2003
- Sun, JDS Release 2
Remedy:
Apply the patch for this vulnerability, available from the CVS SourceForge Web site. See References.
For Gentoo Linux:
Upgrade to the latest version of xv (3.10a-r7 or later), as listed in GLSA 200409-07. See References.
Upgrade to the latest version of imlib, as listed in GLSA 200409-12. See References.
For Mandrake Linux:
Upgrade to the latest imlib package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2004:089 : imlib2 for more information. See References.
Mandrake Linux 9.2: 1.9.14-8.1.92mdk or later
Mandrake Linux Corporate Server 2.1: 1.9.14-5.1.C21mdk or later
Mandrake Linux 10.0: 1.9.14-8.1.100mdk or later
For Sun Java Desktop System:
Apply the appropriate patch for your system, as listed below. Refer to Sun Alert ID: 57645 for more information. See References.
For Debian GNU/Linux 3.0 (alias woody):
Upgrade to the latest imlib2 package (1.0.5-2woody1 or later), as listed in DSA-552-1. See References.
For Conectiva Linux:
Upgrade to the latest imlib package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2004:870 for more information. See References.
Conectiva Linux 10.0: 1.9.14-63739U10_1cl or later
Conectiva Linux 9: 1.9.14-29233U90_1cl or later
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Gain Access
References:
- Conectiva Linux Security Announcement CLSA-2004:870, Fix for a buffer overflow in imlib and imlib2 at http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=000870.
- CVS SourceForge Web site, imlib2 patch at http://cvs.sourceforge.net/viewcvs.py/enlightenment/e17/.
- Sun Alert ID: 57645, Security Vulnerabilities in imlib Library May Allow a Remote Unprivileged User to Execute Arbitrary Code at http://sunsolve.sun.com/search/document.do?assetkey=1-26-57645-1&searchclause.
- BID-11084: IMLib/IMLib2 Multiple BMP Image Decoding Buffer Overflow Vulnerabilities
- CVE-2004-0802: Buffer overflow in the BMP loader in imlib2 before 1.1.2 allows remote attackers to execute arbitrary code via a specially-crafted BMP image, a different vulnerability than CVE-2004-0817.
- DSA-552: imlib2 -- unsanitised input
- GLSA-200409-07: xv: Buffer overflows in image handling
- GLSA-200409-12: ImageMagick, imlib, imlib2: BMP decoding buffer overflows
- MDKSA-2004:089: Updated imlib/imlib2 packages fix BMP crash vulnerability
Reported:
Aug 31, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net