Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | Updated gtk2 packages fix security flaws and bugs |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2004:466 | First vendor Publication | 2004-09-15 |
| Vendor | RedHat | Last vendor Modification | 2004-09-15 |
| Severity (Vendor) | N/A | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 7.5 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated gtk2 packages that fix several security flaws and bugs are now available. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 3. Problem description: The gtk2 package contains the GIMP ToolKit (GTK+), a library for creating graphical user interfaces for the X Window System. During testing of a previously fixed flaw in Qt (CAN-2004-0691), a flaw was discovered in the BMP image processor of gtk2. An attacker could create a carefully crafted BMP file which would cause an application to enter an infinite loop and not respond to user input when the file was opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0753 to this issue. During a security audit Chris Evans discovered a stack and a heap overflow in the XPM image decoder. An attacker could create a carefully crafted XPM file which could cause an application linked with gtk2 to crash or possibly execute arbitrary code when the file was opened by a victim. (CAN-2004-0782, CAN-2004-0783) Chris Evans also discovered an integer overflow in the ICO image decoder. An attacker could create a carefully crafted ICO file which could cause an application linked with gtk2 to crash when the file was opened by a victim. (CAN-2004-0788) This updated gtk2 package also fixes a few key combination bugs on various X servers, such as Hummingbird, ReflectionX, and X-Win32. If a server was configured to use the Swiss German, Swiss French, or France French keyboard layouts, Mode_Switched characters were unable to be entered within GTK based applications. Users of gtk2 are advised to upgrade to these packages which contain backported patches and are not vulnerable to these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ 5. Bug IDs fixed (http://bugzilla.redhat.com/ for more info): 130450 - CAN-2004-0753 bmp image loader DOS |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2004-466.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-787 | Out-of-bounds Write (CWE/SANS Top 25) |
| 50 % | CWE-190 | Integer Overflow or Wraparound (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10506 | |||
| Oval ID: | oval:org.mitre.oval:def:10506 | ||
| Title: | Integer overflow in the ICO image decoder for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted ICO file. | ||
| Description: | Integer overflow in the ICO image decoder for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (application crash) via a crafted ICO file. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0788 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:10585 | |||
| Oval ID: | oval:org.mitre.oval:def:10585 | ||
| Title: | The BMP image processor for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted BMP file. | ||
| Description: | The BMP image processor for (1) gdk-pixbuf before 0.22 and (2) gtk2 before 2.2.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted BMP file. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0753 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:11539 | |||
| Oval ID: | oval:org.mitre.oval:def:11539 | ||
| Title: | Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687). | ||
| Description: | Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687). | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0782 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1617 | |||
| Oval ID: | oval:org.mitre.oval:def:1617 | ||
| Title: | XPM Image Decoder Buffer Overflow | ||
| Description: | Integer overflow in pixbuf_create_from_xpm (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, allows remote attackers to execute arbitrary code via certain n_col and cpp values that enable a heap-based buffer overflow. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0687). | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0782 | Version: | 4 |
| Platform(s): | Sun Solaris 8 Sun Solaris 9 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:1786 | |||
| Oval ID: | oval:org.mitre.oval:def:1786 | ||
| Title: | XPM Image Decoder Malicious Color String Vulnerability | ||
| Description: | Stack-based buffer overflow in xpm_extract_color (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a certain color string. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0688). | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0783 | Version: | 4 |
| Platform(s): | Sun Solaris 8 Sun Solaris 9 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9348 | |||
| Oval ID: | oval:org.mitre.oval:def:9348 | ||
| Title: | Stack-based buffer overflow in xpm_extract_color (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a certain color string. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0688). | ||
| Description: | Stack-based buffer overflow in xpm_extract_color (io-xpm.c) in the XPM image decoder for gtk+ 2.4.4 (gtk2) and earlier, and gdk-pixbuf before 0.22, may allow remote attackers to execute arbitrary code via a certain color string. NOTE: this identifier is ONLY for gtk+. It was incorrectly referenced in an advisory for a different issue (CVE-2004-0688). | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0783 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:9485 | |||
| Oval ID: | oval:org.mitre.oval:def:9485 | ||
| Title: | Heap-based buffer overflow in the BMP image format parser for the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code. | ||
| Description: | Heap-based buffer overflow in the BMP image format parser for the QT library (qt3) before 3.3.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2004-0691 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-10-10 | Name : SLES9: Security update for gdk-pixbuf File : nvt/sles9p5010087.nasl |
| 2009-10-10 | Name : SLES9: Security update for GTK File : nvt/sles9p5011339.nasl |
| 2009-10-10 | Name : SLES9: Security update for qt3 File : nvt/sles9p5018833.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200408-20 (Qt) File : nvt/glsa_200408_20.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200409-28 (gtk+) File : nvt/glsa_200409_28.nasl |
| 2008-09-04 | Name : FreeBSD Ports: linux-gdk-pixbuf File : nvt/freebsd_linux-gdk-pixbuf.nasl |
| 2008-09-04 | Name : FreeBSD Ports: qt File : nvt/freebsd_qt.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 542-1 (qt-copy) File : nvt/deb_542_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 546-1 (gdk-pixbuf) File : nvt/deb_546_1.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 549-1 (gtk+2.0) File : nvt/deb_549_1.nasl |
| 0000-00-00 | Name : Slackware Advisory SSA:2004-236-01 Qt File : nvt/esoft_slk_ssa_2004_236_01.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 9999 | GdkPixbuf ICO Image Decoding Remote Overflow A remote overflow exists in GdkPixbuf. GdkPixbuf fails to properly validate input in the ICO image decoding functionality resulting in a integer overflow. With a specially crafted request, an attacker can cause a DoS on the affected application resulting in a loss of availability. |
| 9998 | GdkPixbuf xpm_extract_color Remote Overflow A remote overflow exists in the GdkPixbuf library. The xpm_extract_color function contains a boundary error when decoding images which may result in a stack-based overflow. With a specially crafted XPM image, an attacker can execute arbitrary code resulting in a loss of confidentiality, integrity, or availability. |
| 9997 | GdkPixbuf pixbuf_create_from_xpm Local Overflow A remote overflow exists in GdkPixbuf. The pixbuf_create_from_xpm (in io-xpm.c) fails to sanitise input from the .xpm resulting in a heap overflow. With a specially crafted request, an attacker can cause execution of arbitrary code resulting in a loss of integrity. |
| 9996 | GdkPixbuf BMP Processor DoS |
| 9026 | Qt qimage.cpp read_dib Function BMP Handling Overflow A remote overflow exists in Trolltech Qt. The read_dib() fails to check user supplied d resulting in a buffer overflow in at least three blocks of code. With a specially crafted request, an attacker can execute arbitrary code with the privelege of the current user resulting in a loss of confidentiality, integrity, and/or availability. |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2018-02-03 | Qt library BMP image parser heap overflow exploit attempt RuleID : 45306 - Revision : 1 - Type : FILE-IMAGE |
| 2018-02-03 | Qt library BMP image parser heap overflow exploit attempt RuleID : 45305 - Revision : 1 - Type : FILE-IMAGE |
| 2014-01-10 | CVS remote file information disclosure attempt RuleID : 23402 - Revision : 6 - Type : SERVER-WEBAPP |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2009-09-24 | Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_9368.nasl - Type : ACT_GATHER_INFO |
| 2006-01-15 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2005-214.nasl - Type : ACT_GATHER_INFO |
| 2005-07-13 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2004-236-01.nasl - Type : ACT_GATHER_INFO |
| 2005-07-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_3d1e9267073f11d9b45d000c41e2cdad.nasl - Type : ACT_GATHER_INFO |
| 2005-07-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_2001103a6bbd11d9851d000a95bc6fae.nasl - Type : ACT_GATHER_INFO |
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-542.nasl - Type : ACT_GATHER_INFO |
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-546.nasl - Type : ACT_GATHER_INFO |
| 2004-09-29 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-549.nasl - Type : ACT_GATHER_INFO |
| 2004-09-22 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200409-28.nasl - Type : ACT_GATHER_INFO |
| 2004-09-17 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2004_033.nasl - Type : ACT_GATHER_INFO |
| 2004-09-16 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-095.nasl - Type : ACT_GATHER_INFO |
| 2004-09-16 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-096.nasl - Type : ACT_GATHER_INFO |
| 2004-09-15 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-289.nasl - Type : ACT_GATHER_INFO |
| 2004-09-15 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-288.nasl - Type : ACT_GATHER_INFO |
| 2004-09-15 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-287.nasl - Type : ACT_GATHER_INFO |
| 2004-09-15 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-286.nasl - Type : ACT_GATHER_INFO |
| 2004-09-15 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-447.nasl - Type : ACT_GATHER_INFO |
| 2004-09-15 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-466.nasl - Type : ACT_GATHER_INFO |
| 2004-08-30 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200408-20.nasl - Type : ACT_GATHER_INFO |
| 2004-08-23 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_qt_333.nasl - Type : ACT_GATHER_INFO |
| 2004-08-23 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-271.nasl - Type : ACT_GATHER_INFO |
| 2004-08-23 | Name : The remote Fedora Core host is missing a security update. File : fedora_2004-270.nasl - Type : ACT_GATHER_INFO |
| 2004-08-22 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-085.nasl - Type : ACT_GATHER_INFO |
| 2004-08-22 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-414.nasl - Type : ACT_GATHER_INFO |
| 2004-08-20 | Name : The remote host is missing a vendor-supplied security patch File : suse_SA_2004_027.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:48:40 |
|
| 2013-05-11 12:22:37 |
|
