GD Graphics Library gdImageCreateFromGifPtr() GIF file denial of service
| gdgraphicslibrary-gif-dos (26976) |  Low Risk |
Description:
The GD Graphics Library could allow a remote attacker to cause a denial of service, caused by an infinite loop error in the gdImageCreateFromGifPtr() function. An attacker could exploit this vulnerability using a specially-crafted GIF image to consume all available CPU resources on an affected system.
Consequences:
Denial of Service
Remedy:
For Debian GNU/Linux:
Refer to DSA-1117-1 for patch, upgrade, or suggested workaround information. See References.
References:
- Boutell.com: GD Graphics Library.
- BugTraq Mailing List, Tue Jun 06 2006 - 09:02:47 CDT: libgd 2.0.33 infinite loop in GIF decoding ?.
- BID-18294: GD Graphics Library Remote Denial of Service Vulnerability
- BID-18347: GD Graphics Library Truncated GIF File Remote Denial of Service Vulnerability
- CVE-2006-2906: The LZW decoding in the gdImageCreateFromGifPtr function in the Thomas Boutell graphics draw (GD) library (aka libgd) 2.0.33 allows remote attackers to cause a denial of service (CPU consumption) via malformed GIF data that causes an infinite loop.
- DSA-1117: libgd2 -- insufficient input sanitising
- MDKSA-2006:113: Updated tetex packages fix embedded GD vulnerabilities
- MDKSA-2006:122: Updated php packages fix multiple vulnerabilities
- SA20500: GD Graphics Library GIF File Handling Denial of Service
- SUSE-SA:2006:031: php4php5 security problems
- USN-298-1: libgd2 vulnerability
- VUPEN/ADV-2006-2174: GD Graphics Library gdImageCreateFromGifPtr Denial of Service Vulnerability
Platforms Affected:
- Boutell GD Graphics Library 2.0.33
- Canonical Ubuntu 5.04
- Canonical Ubuntu 5.10
- Canonical Ubuntu 6.06 LTS
- Debian Debian Linux 3.1
- MandrakeSoft Mandrake Linux 2006 X86_64
- MandrakeSoft Mandrake Linux 2006
- MandrakeSoft Mandrake Linux LE2005 X86_64
- MandrakeSoft Mandrake Linux LE2005
- MandrakeSoft Mandrake Linux Corporate Server 3.0
- MandrakeSoft Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft Mandrake Multi Network Firewall 2.0
- Novell UnitedLinux 1.0
- SuSE SuSE SLES 9
Reported:
Jun 06, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net