libpng png_handle_sBIT and png_handle_tRNS buffer overflow
libpng-pnghandle-bo (16894) High Risk
Description:
libpng is a Portable Network Graphics (PNG) library for Unix platforms. libpng is vulnerable to a buffer overflow in the png_handle_sBIT and png_handle_tRNS functions, caused by improper bounds checking. By creating a specially-crafted PNG image, a remote attacker could overflow a buffer and cause the program to crash or possibly execute arbitrary code on the system, once the image is processed by libpng.
Platforms Affected:
Conectiva: Conectiva Linux 10
Conectiva: Conectiva Linux 8.0
Conectiva: Conectiva Linux 9.0
Debian: Debian Linux 3.0
Gentoo Technologies, Inc.: Gentoo Linux Any version
GNOME Project: GNOME 2.0
Hewlett-Packard Company: Compaq Tru64 UNIX 5.1a
Hewlett-Packard Company: Compaq Tru64 UNIX 5.1b
libpng project: libpng Any version
MandrakeSoft, Inc.: Mandrake Linux 10.0
MandrakeSoft, Inc.: Mandrake Linux 9.1
MandrakeSoft, Inc.: Mandrake Linux 9.2
MandrakeSoft, Inc.: Mandrake Linux Corporate Server 2.1
MandrakeSoft, Inc.: Mandrake Multi Network Firewall 8.2
Netscape Communications, Inc.: Netscape 7.0
OpenPKG Project: OpenPKG 2.0
OpenPKG Project: OpenPKG 2.1
OpenPKG Project: OpenPKG CURRENT
Red Hat, Inc.: Red Hat Advanced Workstation 2.1
Red Hat, Inc.: Red Hat Desktop 3
Red Hat, Inc.: Red Hat Enterprise Linux 2.1AS
Red Hat, Inc.: Red Hat Enterprise Linux 2.1ES
Red Hat, Inc.: Red Hat Enterprise Linux 2.1WS
Red Hat, Inc.: Red Hat Enterprise Linux 3AS
Red Hat, Inc.: Red Hat Enterprise Linux 3ES
Red Hat, Inc.: Red Hat Enterprise Linux 3WS
Santa Cruz Operation, Inc.: SCO UnixWare 7.1.4
Slackware: Slackware Linux 10.0
Slackware: Slackware Linux 8.1
Slackware: Slackware Linux 9.0
Slackware: Slackware Linux 9.1
Slackware: Slackware Linux current
Sun Microsystems: Solaris 7
Sun Microsystems: Solaris 8
Sun Microsystems: Solaris 9
Sun Microsystems: Sun JDS 2003
Sun Microsystems: Sun JDS Release 2
SuSE: SuSE eMail Server 3.1
SuSE: SuSE eMail Server III Any version
SuSE: SuSE Linux 8.0
SuSE: SuSE Linux 8.1
SuSE: SuSE Linux 8.2
SuSE: SuSE Linux 9.0
SuSE: SuSE Linux 9.1
SuSE: SuSE Linux Connectivity Server Any version
SuSE: SuSE Linux Database Server Any version
SuSE: SuSE Linux Enterprise Server 7
SuSE: SuSE Linux Enterprise Server 8
SuSE: SuSE Linux Firewall Any version
SuSE: SuSE Linux Office Server Any version
Trustix: Trustix Secure Enterprise Linux 2
Trustix: Trustix Secure Linux 2.0
Trustix: Trustix Secure Linux 2.1
TurboLinux, Inc.: Turbolinux 10 Desktop
TurboLinux, Inc.: Turbolinux 7 Server
TurboLinux, Inc.: Turbolinux 7 Workstation
TurboLinux, Inc.: Turbolinux 8 Server
TurboLinux, Inc.: Turbolinux 8 Workstation
TurboLinux, Inc.: Turbolinux Appliance Server 1.0
TurboLinux, Inc.: TurboLinux Advanced Server 6
TurboLinux, Inc.: Turbolinux Server 6.1
TurboLinux, Inc.: Turbolinux Server 6.5
TurboLinux, Inc.: Turbolinux Workstation 6.0
Remedy:
For Microsoft Windows:
Apply the appropriate patch for your system, as listed in Microsoft Security Bulletin MS05-009. See References.
For Red Hat Linux:
Upgrade to the latest libpng package, as listed below. Refer to Red Hat Security Advisory RHSA-2004:402-08 for more information. See References.
Red Hat Enterprise Linux AS (v. 3), ES (v. 3), WS (v. 3) and Red Hat Desktop 3: 1.2.2-25 or later
Red Hat Enterprise Linux AS (v. 2.1), ES (v. 2.1), WS (v. 2.1) and Red Hat Linux Advanced Workstation 2.1: 1.0.14-7 or later
Upgrade to the latest mozilla package, as listed below. Refer to Red Hat Security Advisory RHSA-2004:421-17 for more information. See References.
Red Hat Enterprise Linux AS (v. 2.1), ES (v. 2.1), WS (v. 2.1), and Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor: 1.4.3-2.1.2 or later
Red Hat Enterprise Linux AS (v. 3), ES (v. 3), WS (v. 3), Desktop: 1.4.3-3.0.2.x86_64 or later
For OpenPKG:
Upgrade to the latest libpng package, as listed below. Refer to OpenPKG Security Advisory OpenPKG-SA-2004.035-png for more information. See References.
OpenPKG CURRENT: 1.2.5-20040804 or later
OpenPKG 2.0: 1.2.5-2.1.1 or later
OpenPKG 2.1: 1.2.5-2.0.3 or later
For SuSE Linux:
Upgrade to the latest libpng package, as listed below. Refer to SuSE Security Announcement SUSE-SA:2004:023 for more information. See References.
SuSE Linux 9.1: 1.2.5-182.7 or later
SuSE Linux 9.0 and 8.2: 1.2.5-191 or later
SuSE Linux 8.0: 2.1.0.12-169 or later
SuSE Linux 8.1: 2.2.8a-218 or later
For Mandrake Linux:
Upgrade to the latest libpng package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2004:079 : libpng for more information. See References.
Mandrake Linux 9.1: 1.2.5-2.5.91mdk or later
Mandrake Linux 9.2: 1.2.5-7.5.92mdk or later
Mandrake Linux Multi Network Firewall 8.2: 1.2.4-3.7.M82mdk or later
Mandrake Linux Corporate Server 2.1:1.2.4-3.7.C21mdk or later
Mandrake Linux 10.0: 1.2.5-10.5.100mdk or later
Upgrade to the latest mozilla package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2004:082 : mozilla for more information. See References.
Mandrake Linux 9.2:1.4-13.3.92mdk or later
Mandrake Linux 10.0: 1.6-12.1.100mdk or later
For Debian GNU/Linux 3.0 (alias woody):
Upgrade to the latest libpng package (1.0.12-3 or later), as listed in Debian Security Advisory DSA-536-1. See References.
For Gentoo Linux:
Upgrade to the latest version of libpng, as listed in Gentoo Linux Security Advisory GLSA 200408-03. See References.
For Trustix Secure Linux:
Upgrade to the latest libpng package, as listed below. Refer to Trustix Secure Linux Security Advisory #2004-0040 for more information. See References.
Trustix Secure Linux 2.0: 1.2.5-7tr or later
Trustix Secure Linux 2.1 and Enterprise Linux 2: 1.2.5-12tr or later
For Conectiva Linux:
Upgrade to the latest libpng package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2004:856 for more information. See References.
Conectiva Linux 10.0: 1.0.15-42714U10_1cl or later Conectiva Linux 8: 1.0.14-1U80_1cl or later Conectiva Linux 9: 1.0.15-22380U90_1cl or later
For HP Tru64 UNIX 5.1A and 5.1B:
Apply the appropriate Patches for your system, as listed in Hewlett-Packard Company Security Bulletin: HPSBTU01063. See References.
For Slackware Linux:
Upgrade to the latest libpng package, as listed below. Refer to slackware-security Mailing List, Mon, 9 Aug 2004 20:40:50 -0700 (PDT) and Tue, 10 Aug 2004 12:54:52 -0700 (PDT) for more information. See References.
Slackware Linux 8.1: 1.2.5-i386-1 or later
Slackware Linux 9.0 and 9.1:1.2.5-i486-3 or later
Slackware Linux 10.0 and -current: 1.2.5-i486-3 or later
For Slackware Linux:
Upgrade to the latest imagemagick package, as listed below. Refer to slackware-security Mailing List, Tue, 10 Aug 2004 14:26:39 -0700 (PDT) for more information. See References.
Slackware Linux 9.0 : 5.5.7_25-i486-1or later
Slackware Linux 10.0 and -current: 6.0.4_3-i486-1 or later
For Slackware Linux:
Upgrade to the latest mozilla package, as listed below. Refer to slackware-security Mailing List, Tue, 10 Aug 2004 14:17:12 -0700 (PDT) for more information. See References.
Slackware Linux 9.1: 1.4.3-i486-1 or later
Slackware Linux 10.0 and -current: 1.7.2-i486-1 or later
For Turbolinux:
Upgrade to the latest libpng package, as listed below. Refer to Turbolinux Security Advisory TLSA-2004-19 for more information. See References.
Turbolinux Appliance Server 1.0 Hosting Edition: 1.2.4-6 or later
Turbolinux Appliance Server 1.0 Workgroup Edition: 1.2.4-6 or later
Turbolinux 10 Desktop and Turbolinux 10 F: 1.2.5-7 or later
Tturbolinux 8 Server and 8 Workstation: 1.2.4-6 or later
Turbolinux 7 Server and 7 Workstation: 1.0.12-8 or later
Turbolinux Server 6.5 and Advanced Server 6: 1.0.12-8 or later
Turbolinux Server 6.1and Workstation 6.0: 1.0.12-8 or later
For Gentoo Linux:
Upgrade to the latest version of mozilla, as listed in Gentoo Linux Security Advisory GLSA 200408-22. See References.
For SCO UnixWare 7.1.4:
Upgrade to the appropriate fixed binaries, as listed in SCO Security Advisory SCOSA-2004.16. See References.
For Sun Solaris and Sun JDS:
Apply the appropriate patch for your system, as listed below. Refer to Sun Alert Notification 57617 for more information. See References.
SPARC Platform:
Solaris 8 GNOME 2.0 with patch 114816-02 or later
Solaris 9 GNOME 2.0 with patches 114818-06 or later and 114820-05 or later
Solaris 9 GNOME 2.0.2 with patch 114822-04 or later
Note: Both patches for GNOME 2.0 on Solaris 9 must be installed to resolve this issue (114818-06 is 32-bit; 114820-05 is 64-bit).
X86 Platform:
Solaris 8 GNOME 2.0 with patch 114817-02 or later
Solaris 9 GNOME 2.0 with patch 114819-06 or later
Linux Platform:
Sun Java Desktop Systems (JDS) release 2003 and JDS release 2 with the updated RPMs (patch-9279)
For Conectiva Linux:
Upgrade to the latest mozilla package, as listed below. Refer to Conectiva Linux Security Announcement CLSA-2004:877 for more information. See References.
Conectiva Linux 10.0: 1.7.3-60868U10_1cl or later
Conectiva Linux 9: 1.7.3-27852U90_4cl or later
For other distributions:
Contact your vendor for upgrade or patch information.
実証コード
http://downloads.securityfocus.com/vulnerabilities/exploits/libpng.c
http://downloads.securityfocus.com/vulnerabilities/exploits/msnMessengerPNGexploit.c