The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Multiple Vendor GIMP Multiple Integer Overflow Vulnerabilities
------------------------------------------------------------------------
SUMMARY
The GNU Image Manipulation Program is "commonly known as the GIMP. It is a
freely distributed piece of software for such tasks as photo retouching,
image composition and image authoring. It is available, in many languages,
for multiple operating systems". Remote exploitation of multiple integer
overflow vulnerabilities in several of the image loader plug-ins included
with distributions of 'The GIMP' allow attackers to crash The GIMP or
potentially execute arbitrary code with the privileges of the user.
DETAILS
Vulnerable Systems:
* GIMP version 2.2.15
Immune Systems:
* GIMP version 2.2.16
The following lines show the location of some vulnerabilities within the
code responsible for loading the DICOM, PNM, PSD, PSP, Sun RAS, XBM, and
XWD file formats. Each of the files are located within the plug-ins/common
directory of the source code.
dicom.c:391: value = g_new0 (guint8, element_length + 4);
pnm.c:566: data = g_new (guchar, gimp_tile_height () * info->xres *
np);
pnm.c:628: data = g_new (guchar, gimp_tile_height () * info->xres *
info->np);
pnm.c:681: data = g_new (guchar, gimp_tile_height () * info->xres);
psd.c:2969: PSDheader.rowlength = g_malloc (PSDheader.rows *
psp.c:1225: pixel = g_malloc0 (height * width * bytespp);
sunras.c:955: data = g_malloc (tile_height * width);
sunras.c:1076: data = g_malloc (tile_height * width);
sunras.c:1146: data = g_malloc (tile_height * width * 3);
sunras.c:1231: data = g_malloc (tile_height * width * 3);
xbm.c:879: data = (guchar *) g_malloc (width * tileheight);
xwd.c:1193: data = g_malloc (tile_height * width);
xwd.c:1195: scanline = g_new (guchar, xwdhdr->l_bytes_per_line + 8);
xwd.c:1352: data = g_malloc (tile_height * width);
xwd.c:1441: data = g_malloc (tile_height * width * 3);
xwd.c:1601: data = g_malloc (tile_height * width * 3);
xwd.c:1812: data = g_malloc (tile_height * width * bytes_per_pixel);
In each case, an integer value from an untrusted input source has
arithmetic operations performed upon it to calculate the length to
allocate. Since no integer overflow checking is performed, a potentially
exploitable heap overflow may result.
This is not a complete list of integer overflow vulnerabilities in the
code.
Analysis:
Exploitation allows attackers to execute arbitrary code in the context of
the user opening a malicious image file.
In order to be successful, the attacker must convince the victim into
opening a maliciously crafted image with The GIMP.
Workaround:
Consider moving the affected loader modules from The GIMP's plug-in
directory to another location. The location in the file system may vary
depending on distributions. On Red Hat Linux and Debian systems the
default plug-in directory is /usr/lib/gimp/2.0/plug-ins.
Vendor response:
The GIMP maintainers have released version 2.2.16 to address these
vulnerabilities. For more information, consult the following URL:
<http://developer.gimp.org/NEWS-2.2> http://developer.gimp.org/NEWS-2.2
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4519>
CVE-2006-4519
Disclosure timeline:
08/17/2006 - Initial vendor notification
10/06/2006 - Second vendor notification
06/26/2007 - Third vendor notification
06/26/2007 - Initial vendor response
07/09/2007 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by Sean Larsson (iDefense Labs).
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=551>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=551
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
