chmlib _chm_decompress_block() buffer overflow
| chmlib-chmdecompressblock-bo (22885) |  High Risk |
Description:
chmlib is vulnerable to a buffer overflow caused by a vulnerability in the _chm_decompress_block() function. A remote attacker could send a specially-crafted .chm file which, once is processed by the _chm_decompress_block() function, would cause a stack-based buffer overflow. A remote attacker could exploit this vulnerability to execute arbitrary code on the victim's system.
Platforms Affected:
- Debian, Debian Linux 3.1
- Gentoo, Linux
- Jed Wing, CHM Lib 0.36 and prior
Remedy:
Upgrade to the latest version of chmlib (0.37 or later), available from the chmlib Web site. See References.
For Debian GNU/Linux:
Refer to DSA-886-1 for patch, upgrade, or suggested workaround information. See References.
For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 2005-11-23 for patch, upgrade, or suggested workaround information. See References.
Consequences:
Gain Access
References:
- CHM Lib Web site, CHM Lib at http://morte.jedrea.com/%7Ejedwin/projects/chmlib/.
- Full-Disclosure Mailing List, Wed Oct 26 2005 - 09:19:18 CDT, chmlib exploitable buffer overflow at http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0536.html.
- BID-15211: Jed Wing CHM Lib Stack Buffer Overflow Vulnerability
- BID-15338: Jed Wing CHM Lib LZX Decompression Method Buffer Overflow Vulnerability
- CVE-2005-2659: Buffer overflow in the LZX decompression in CHM Lib (chmlib) 0.35, as used in products such as KchmViewer, has unknown impact and attack vectors.
- CVE-2005-3318: Buffer overflow in the _chm_decompress_block function in CHM lib (chmlib) before 0.37, as used in products such as KchmViewer, allows attackers execute arbitrary code, a different vulnerability than CVE-2005-2930.
- DSA-886: chmlib -- several vulnerabilities
- GLSA-200511-23: chmlib, KchmViewer: Stack-based buffer overflow
- OSVDB ID: 20335: chmlib _chm_decompress_block() Function CHM File Processing Overflow
- SA17325: CHM Lib Multiple Buffer Overflow Vulnerabilities
- SA17775: KchmViewer chmlib Buffer Overflow Vulnerabilities
- SUSE-SR:2005:025: SUSE Security Summary Report
- VUPEN/ADV-2005-2207: CHMlib chm_decompress_block Function Buffer Overflow Vulnerability
Reported:
Oct 26, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net