Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Updated gdk-pixbuf packages fix security flaws
Informations
Name RHSA-2004:447 First vendor Publication 2004-09-15
Vendor RedHat Last vendor Modification 2004-09-15
Severity (Vendor) N/A Revision 02

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated gdk-pixbuf packages that fix several security flaws are now available.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Problem description:

The gdk-pixbuf package contains an image loading library used with the GNOME GUI desktop environment.

[Updated 15th September 2004] Packages have been updated to correct a bug which caused the xpm loader to fail.

During testing of a previously fixed flaw in Qt (CAN-2004-0691), a flaw was discovered in the BMP image processor of gdk-pixbuf. An attacker could create a carefully crafted BMP file which would cause an application to enter an infinite loop and not respond to user input when the file was opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0753 to this issue.

During a security audit, Chris Evans discovered a stack and a heap overflow in the XPM image decoder. An attacker could create a carefully crafted XPM file which could cause an application linked with gtk2 to crash or possibly execute arbitrary code when the file was opened by a victim. (CAN-2004-0782, CAN-2004-0783)

Chris Evans also discovered an integer overflow in the ICO image decoder. An attacker could create a carefully crafted ICO file which could cause an application linked with gtk2 to crash when the file is opened by a victim. (CAN-2004-0788)

These packages have also been updated to correct a bug which caused the xpm loader to fail.

Users of gdk-pixbuf are advised to upgrade to these packages, which contain backported patches and are not vulnerable to these issues.

4. Solution:

Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/ for more info):

130455 - CAN-2004-0753 bmp image loader DOS 130711 - CAN-2004-0782/3/8 GTK XPM decoder issues

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2004-447.html

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-787 Out-of-bounds Write (CWE/SANS Top 25)
50 % CWE-190 Integer Overflow or Wraparound (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10506
 
Oval ID: oval:org.mitre.oval:def:10506
Title: Integer overflow in the ICO image decoder for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted ICO file.
Description: Integer overflow in the ICO image decoder for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted ICO file.
Family: unix Class: vulnerability
Reference(s): CVE-2004-0788
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:10585
 
Oval ID: oval:org.mitre.oval:def:10585
Title: The BMP image processor for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted BMP file.
Description: The BMP image processor for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted BMP file.
Family: unix Class: vulnerability
Reference(s): CVE-2004-0753
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:11539
 
Oval ID: oval:org.mitre.oval:def:11539
Title: Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687).
Description: Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687).
Family: unix Class: vulnerability
Reference(s): CVE-2004-0782
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:1617
 
Oval ID: oval:org.mitre.oval:def:1617
Title: XPM Image Decoder Buffer Overflow
Description: Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687).
Family: unix Class: vulnerability
Reference(s): CVE-2004-0782
 Version: 4
Platform(s): Sun Solaris 8
Sun Solaris 9
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:1786
 
Oval ID: oval:org.mitre.oval:def:1786
Title: XPM Image Decoder Malicious Color String Vulnerability
Description: Stack-based buffer overflow in xpm_extract_color (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a certain color string. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0688).
Family: unix Class: vulnerability
Reference(s): CVE-2004-0783
 Version: 4
Platform(s): Sun Solaris 8
Sun Solaris 9
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9348
 
Oval ID: oval:org.mitre.oval:def:9348
Title: Stack-based buffer overflow in xpm_extract_color (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a certain color string. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0688).
Description: Stack-based buffer overflow in xpm_extract_color (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a certain color string. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0688).
Family: unix Class: vulnerability
Reference(s): CVE-2004-0783
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:9485
 
Oval ID: oval:org.mitre.oval:def:9485
Title: Heap-based buffer overflow in the BMP image format parser for the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code.
Description: Heap-based buffer overflow in the BMP image format parser for the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code.
Family: unix Class: vulnerability
Reference(s): CVE-2004-0691
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
 Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 4
Application 7
Application 12

OpenVAS Exploits

Date Description
2009-10-10 Name : SLES9: Security update for gdk-pixbuf
File : nvt/sles9p5010087.nasl
2009-10-10 Name : SLES9: Security update for GTK
File : nvt/sles9p5011339.nasl
2009-10-10 Name : SLES9: Security update for qt3
File : nvt/sles9p5018833.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200408-20 (Qt)
File : nvt/glsa_200408_20.nasl
2008-09-24 Name : Gentoo Security Advisory GLSA 200409-28 (gtk+)
File : nvt/glsa_200409_28.nasl
2008-09-04 Name : FreeBSD Ports: linux-gdk-pixbuf
File : nvt/freebsd_linux-gdk-pixbuf.nasl
2008-09-04 Name : FreeBSD Ports: qt
File : nvt/freebsd_qt.nasl
2008-01-17 Name : Debian Security Advisory DSA 542-1 (qt-copy)
File : nvt/deb_542_1.nasl
2008-01-17 Name : Debian Security Advisory DSA 546-1 (gdk-pixbuf)
File : nvt/deb_546_1.nasl
2008-01-17 Name : Debian Security Advisory DSA 549-1 (gtk+2.0)
File : nvt/deb_549_1.nasl
0000-00-00 Name : Slackware Advisory SSA:2004-236-01 Qt
File : nvt/esoft_slk_ssa_2004_236_01.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
9999 GdkPixbuf ICO Image Decoding Remote Overflow

A remote overflow exists in GdkPixbuf. GdkPixbuf fails to properly validate input in the ICO image decoding functionality resulting in a integer overflow. With a specially crafted request, an attacker can cause a DoS on the affected application resulting in a loss of availability.
9998 GdkPixbuf xpm_extract_color Remote Overflow

A remote overflow exists in the GdkPixbuf library. The xpm_extract_color function contains a boundary error when decoding images which may result in a stack-based overflow. With a specially crafted XPM image, an attacker can execute arbitrary code resulting in a loss of confidentiality, integrity, or availability.
9997 GdkPixbuf pixbuf_create_from_xpm Local Overflow

A remote overflow exists in GdkPixbuf. The pixbuf_create_from_xpm (in io-xpm.c) fails to sanitise input from the .xpm resulting in a heap overflow. With a specially crafted request, an attacker can cause execution of arbitrary code resulting in a loss of integrity.
9996 GdkPixbuf BMP Processor DoS
9026 Qt qimage.cpp read_dib Function BMP Handling Overflow

A remote overflow exists in Trolltech Qt. The read_dib() fails to check user supplied d resulting in a buffer overflow in at least three blocks of code. With a specially crafted request, an attacker can execute arbitrary code with the privelege of the current user resulting in a loss of confidentiality, integrity, and/or availability.

Snort® IPS/IDS

Date Description
2018-02-03 Qt library BMP image parser heap overflow exploit attempt
RuleID : 45306 - Revision : 1 - Type : FILE-IMAGE
2018-02-03 Qt library BMP image parser heap overflow exploit attempt
RuleID : 45305 - Revision : 1 - Type : FILE-IMAGE
2014-01-10 CVS remote file information disclosure attempt
RuleID : 23402 - Revision : 6 - Type : SERVER-WEBAPP

Nessus® Vulnerability Scanner

Date Description
2009-09-24 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_9368.nasl - Type : ACT_GATHER_INFO
2006-01-15 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2005-214.nasl - Type : ACT_GATHER_INFO
2005-07-13 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2004-236-01.nasl - Type : ACT_GATHER_INFO
2005-07-13 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_3d1e9267073f11d9b45d000c41e2cdad.nasl - Type : ACT_GATHER_INFO
2005-07-13 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_2001103a6bbd11d9851d000a95bc6fae.nasl - Type : ACT_GATHER_INFO
2004-09-29 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-542.nasl - Type : ACT_GATHER_INFO
2004-09-29 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-546.nasl - Type : ACT_GATHER_INFO
2004-09-29 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-549.nasl - Type : ACT_GATHER_INFO
2004-09-22 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200409-28.nasl - Type : ACT_GATHER_INFO
2004-09-17 Name : The remote host is missing a vendor-supplied security patch
File : suse_SA_2004_033.nasl - Type : ACT_GATHER_INFO
2004-09-16 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2004-095.nasl - Type : ACT_GATHER_INFO
2004-09-16 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2004-096.nasl - Type : ACT_GATHER_INFO
2004-09-15 Name : The remote Fedora Core host is missing a security update.
File : fedora_2004-289.nasl - Type : ACT_GATHER_INFO
2004-09-15 Name : The remote Fedora Core host is missing a security update.
File : fedora_2004-288.nasl - Type : ACT_GATHER_INFO
2004-09-15 Name : The remote Fedora Core host is missing a security update.
File : fedora_2004-287.nasl - Type : ACT_GATHER_INFO
2004-09-15 Name : The remote Fedora Core host is missing a security update.
File : fedora_2004-286.nasl - Type : ACT_GATHER_INFO
2004-09-15 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2004-447.nasl - Type : ACT_GATHER_INFO
2004-09-15 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2004-466.nasl - Type : ACT_GATHER_INFO
2004-08-30 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200408-20.nasl - Type : ACT_GATHER_INFO
2004-08-23 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_qt_333.nasl - Type : ACT_GATHER_INFO
2004-08-23 Name : The remote Fedora Core host is missing a security update.
File : fedora_2004-271.nasl - Type : ACT_GATHER_INFO
2004-08-23 Name : The remote Fedora Core host is missing a security update.
File : fedora_2004-270.nasl - Type : ACT_GATHER_INFO
2004-08-22 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2004-085.nasl - Type : ACT_GATHER_INFO
2004-08-22 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2004-414.nasl - Type : ACT_GATHER_INFO
2004-08-20 Name : The remote host is missing a vendor-supplied security patch
File : suse_SA_2004_027.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-02-17 11:48:38
  • Multiple Updates
2013-05-11 12:22:36
  • Multiple Updates