|
|
|
|
| |
Credit:
The information has been provided by Sean Larsson (iDefense Labs).
The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=551
|
| |
Vulnerable Systems:
* GIMP version 2.2.15
Immune Systems:
* GIMP version 2.2.16
The following lines show the location of some vulnerabilities within the code responsible for loading the DICOM, PNM, PSD, PSP, Sun RAS, XBM, and XWD file formats. Each of the files are located within the plug-ins/common directory of the source code.
dicom.c:391: value = g_new0 (guint8, element_length + 4);
pnm.c:566: data = g_new (guchar, gimp_tile_height () * info->xres * np);
pnm.c:628: data = g_new (guchar, gimp_tile_height () * info->xres * info->np);
pnm.c:681: data = g_new (guchar, gimp_tile_height () * info->xres);
psd.c:2969: PSDheader.rowlength = g_malloc (PSDheader.rows *
psp.c:1225: pixel = g_malloc0 (height * width * bytespp);
sunras.c:955: data = g_malloc (tile_height * width);
sunras.c:1076: data = g_malloc (tile_height * width);
sunras.c:1146: data = g_malloc (tile_height * width * 3);
sunras.c:1231: data = g_malloc (tile_height * width * 3);
xbm.c:879: data = (guchar *) g_malloc (width * tileheight);
xwd.c:1193: data = g_malloc (tile_height * width);
xwd.c:1195: scanline = g_new (guchar, xwdhdr->l_bytes_per_line + 8);
xwd.c:1352: data = g_malloc (tile_height * width);
xwd.c:1441: data = g_malloc (tile_height * width * 3);
xwd.c:1601: data = g_malloc (tile_height * width * 3);
xwd.c:1812: data = g_malloc (tile_height * width * bytes_per_pixel);
In each case, an integer value from an untrusted input source has arithmetic operations performed upon it to calculate the length to allocate. Since no integer overflow checking is performed, a potentially exploitable heap overflow may result.
This is not a complete list of integer overflow vulnerabilities in the code.
Analysis:
Exploitation allows attackers to execute arbitrary code in the context of the user opening a malicious image file.
In order to be successful, the attacker must convince the victim into opening a maliciously crafted image with The GIMP.
Workaround:
Consider moving the affected loader modules from The GIMP's plug-in directory to another location. The location in the file system may vary depending on distributions. On Red Hat Linux and Debian systems the default plug-in directory is /usr/lib/gimp/2.0/plug-ins.
Vendor response:
The GIMP maintainers have released version 2.2.16 to address these vulnerabilities. For more information, consult the following URL: http://developer.gimp.org/NEWS-2.2
CVE Information:
CVE-2006-4519
Disclosure timeline:
08/17/2006 - Initial vendor notification
10/06/2006 - Second vendor notification
06/26/2007 - Third vendor notification
06/26/2007 - Initial vendor response
07/09/2007 - Coordinated public disclosure
|
|
|
|
|
