libpng png_set_sPLT function denial of service
| libpng-pngsetsplt-dos (30290) |  Low Risk |
Description:
libpng is vulnerable to a denial of service, caused by an out-of-bounds read in the png_set_sPLT function in pngset.c. By sending a specially-crafted PNG file, a remote attacker could crash applications linked to the vulnerable library.
Platforms Affected:
- Apple, Mac OS X 10.5.2
- Apple, Mac OS X Server 10.5.2
- Canonical, Ubuntu 5.10
- Canonical, Ubuntu 6.06 LTS
- Canonical, Ubuntu 6.10
- Gentoo, Linux
- Google, Android SDK m3-rc37a
- libpng, libpng prior to 1.2.12
- Mandriva, Corporate Server 3.0 X86_64
- Mandriva, Corporate Server 3.0
- Mandriva, Corporate Server 4.0
- Mandriva, Corporate Server 4.0 X86_64
- Mandriva, Linux 2006
- Mandriva, Linux 2006 X86_64
- Mandriva, Linux 2007 X86_64
- Mandriva, Linux 2007
- Mandriva, Multi Network Firewall 2.0
- OpenPKG, OpenPKG 2-STABLE
- OpenPKG, OpenPKG 2-STABLE-20061018
- OpenPKG, OpenPKG CURRENT
- OpenPKG, OpenPKG Enterprise E1.0-SOLID
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 5 Server
- RedHat, Enterprise Linux 5
- RedHat, Enterprise Linux 5 Client Workstation
- RedHat, Enterprise Linux 5 Client
- RedHat, Enterprise Linux Desktop 5.0
- RedHat, Linux Advanced Workstation 2.1 Itanium
- Turbolinux, Turbolinux 10 Desktop
- Turbolinux, Turbolinux 10 F...
- Turbolinux, Turbolinux 10 Server
- Turbolinux, Turbolinux 10 Server x64 Ed
- Turbolinux, Turbolinux 8 Server
- Turbolinux, Turbolinux FUJI
- Turbolinux, Turbolinux Home
- Turbolinux, Turbolinux Multimedia
- Turbolinux, Turbolinux Personal
- Turbolinux, Turbolinux wizpy
- Turbolinux, Turbolinux Appliance Server 1.0 Hosting Ed
- Turbolinux, Turbolinux Appliance Server 1.0 Workgroup Ed
- Turbolinux, Turbolinux Appliance Server 2.0
Remedy:
For Gentoo:
Apply the patch for this vulnerability, as listed in Gentoo Bugzilla Bug 154380. See References.
For Mandriva Linux:
Refer to Mandriva Linux Security Advisory MDKSA-2006:210 for patch, upgrade, or suggested workaround information. See References.
For Mandriva Linux:
Refer to Mandriva Linux Security Advisory MDKSA-2006:209 for patch, upgrade, or suggested workaround information. See References.
For Gentoo Linux:
Refer to Gentoo Linux Security Announcement GLSA 200611-09 for patch, upgrade, or suggested workaround information. See References.
For Ubuntu Linux:
Refer to USN-383-1 for patch, upgrade, or suggested workaround information. See References.
For Red Hat Linux:
Refer to RHSA-2007:0356 for patch, upgrade, or suggested workaround information. See References.
For Turbolinux (libpng):
Refer to TLSA-2007-45 for patch, upgrade, or suggested workaround information. See References.
For Mac OS X:
Apply Security Update 2008-002, available from the Apple Web site. See References.
For other distributions:
Contact your vendor for upgrade or patch information.
Consequences:
Denial of Service
References:
- Apple Web site, About Security Update 2008-002 at http://docs.info.apple.com/article.html?artnum=307562.
- CORE-2008-0124, Multiple vulnerabilities in Google's Android SDK at http://www.coresecurity.com/?action=item&id=2148.
- Gentoo Bugzilla Bug 154380, media-libs/libpng: sPLT chunk handling denial of service (CVE-2006-5793) at http://bugs.gentoo.org/show_bug.cgi?id=154380.
- ASA-2007-254: libpng security update (RHSA-2007-0356)
- BID-21078: The 'libpng' Graphics Library PNG_SET_SPLT Remote Denial of Service Vulnerability
- CVE-2006-5793: The sPLT chunk handling code (png_set_sPLT function in pngset.c) in libpng 1.0.6 through 1.2.12 uses a sizeof operator on the wrong data type, which allows context-dependent attackers to cause a denial of service (crash) via malformed sPLT chunks that trigger an out-of-bounds read.
- FrSIRT/ADV-2006-4521: libPNG png_set_sPLT() Chunk Handling Remote Denial of Service Vulnerability
- FrSIRT/ADV-2008-0924: Apple Mac OS X Command Execution and Security Bypass Issues
- GLSA-200611-09: libpng: Denial of Service
- MDKSA-2006:209: Updated libpng packages fix vulnerabilities
- MDKSA-2006:210: Updated syslinux packages to fix embedded libpng vulnerabilities
- MDKSA-2006:211: Updated pxelinux packages to fix embedded libpng vulnerabilities
- MDKSA-2006:212: Updated doxygen packages to fix embedded libpng vulnerabilities
- OpenPKG-SA-2006.036: libpng
- RHSA-2007-0356: Moderate: libpng security update
- SA22900: libpng sPLT Chunk Handling Denial of Service
- SA25742: Avaya Products libpng tRNS/sPLT Chunk Denial of Service
- SA29420: Mac OS X Security Update Fixes Multiple Vulnerabilities
- SECTRACK ID: 1017244: libpng Read Error in png_set_sPLT() Lets Remote Users Deny Service
- SUSE-SR:2006:028: SUSE Security Summary Report
Reported:
Nov 07, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net