libxpm4: Three exploitable overflows in XPM handling
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
libxpm (Debian) |
Fix Released
|
Unknown
|
|||
libxpm (Ubuntu) |
Invalid
|
High
|
Unassigned |
Bug Description
Automatically imported from Debian bug report #272493 http://
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #1 |
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #2 |
Message-Id: <20040920120211
Date: Mon, 20 Sep 2004 14:02:11 +0200
From: =?iso-8859-
To: Debian Bug Tracking System <email address hidden>
Subject: libxpm4: Three exploitable overflows in XPM handling
Package: libxpm4
Version: 4.3.0-0pre1v5.
Severity: grave
Tags: security
Justification: user security hole
There are three exploitable stack and integer overflows in the
XPM handling code shipped with XFree: Full details can be found
in this advisory from Chris Evans which I copied at the end of
this mail for archival purposes.
Cheers,
Moritz
http://
libXpm multiple image parsing flaws
=======
Programs affected: libXpm, and any programs which use libXpm to decode XPM
files. For example, the GIMP seems to use libXpm.
Severity: Compromise of account used to browse malicious XPM file.
CAN identifier(s): CAN-2004-0687 and CAN-2004-0688
Fixed: X.ORG release 6.8.1 contains fixes.
This advisory lists code flaws discovered by inspection of the libXpm code.
The specific version of libXpm discussed is the release that comes with the
initial X.ORG X11 system source code release. However, these flaws seem to
exist in older versions.
Flaw 1. Stack-based overflow in xpmParseColors (parse.c).
This is CAN-2004-0687
Careless use of strcat() in both the XPMv1 and XPMv2/3 parsing code leads to
a stack based overflow that should be exploitable. There are minor
complications due to stack layout; the buffer being overflowed in fact
typically overflows into another buffer that is used to populate the overflowed
buffer. This should not prevent exploitation, however.
Demo XPM: http://
Flaw 2. Integer overflow allocating colorTable in xpmParseColors (parse.c) -
probably a crashable but not exploitable offence. Here:
This is CAN-2004-0688
colorTable = (XpmColor *) XpmCalloc(ncolors, sizeof(XpmColor));
ncolors would seem to come from the (untrusted) XPM file.
In fact, multiple integer overflow problems seem to exist. Some may well be
exploitable. Note that the following may not be an exhaustive list:
a) XpmCreateImageF
image_pixels = (Pixel *) XpmMalloc(
(ncolors is user-supplied)
b) CreateXImage:
*image_return = XCreateImage(
width, height, bitmap_pad, 0);
(width and height are user-supplied, possibly other variables too)
c) ParsePixels:
iptr2 = (unsigned int *) XpmMalloc(
(width and height are user-supplied)
d) ParseAndPutPixels and ParsePixels:
cidx[
(possibly, char1 might be negative, and access the cidx array out of bounds)
Flaw 3. Stack overflow reading pixel values in ParseAndPutPixels (create.c) as
well as ParsePixels (parse.c). Should be exploitable.
This is CAN-2004-0687
A user-supplied number of bytes are stuffed into a fixed-size buffer (typically
8192 bytes). The user gets to choose how many bytes to put into this...
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#3 |
On Mon, Sep 20, 2004 at 02:02:11PM +0200, Moritz M??hlenhoff wrote:
> There are three exploitable stack and integer overflows in the
> XPM handling code shipped with XFree: Full details can be found
> in this advisory from Chris Evans which I copied at the end of
> this mail for archival purposes.
Branden Robinson has the patch and is handling the DSA for woody; I
understnad he is also handling the 4.3 upload for sid. Branden?
--
Daniel Stone <email address hidden>
Debian: the universal operating system http://
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Fabio Massimo Di Nitto (fabbione) wrote : | #4 |
We already fixed this problem.
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #5 |
Message-ID: <email address hidden>
Date: Mon, 20 Sep 2004 06:48:28 -0700
From: Daniel Stone <email address hidden>
To: Moritz M??hlenhoff <email address hidden>,
<email address hidden>
Cc: Debian Bug Tracking System <email address hidden>
Subject: DSA and sid uploads needed (was: Re: Bug#272493: libxpm4: Three exploitable overflows in
XPM handling)
--WetXT0Y5FME7H56p
Content-Type: text/plain; charset=us-ascii
Content-
Content-
On Mon, Sep 20, 2004 at 02:02:11PM +0200, Moritz M??hlenhoff wrote:
> There are three exploitable stack and integer overflows in the
> XPM handling code shipped with XFree: Full details can be found
> in this advisory from Chris Evans which I copied at the end of
> this mail for archival purposes.
Branden Robinson has the patch and is handling the DSA for woody; I
understnad he is also handling the 4.3 upload for sid. Branden?
--=20
Daniel Stone <daniels@debian=
=2Eorg>
Debian: the universal operating system http://
n.org
--WetXT0Y5FME7H56p
Content-Type: application/
Content-
Content-
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iD8DBQFBTt+
ojv4ali2Ih3HtrJ
=FCdx
-----END PGP SIGNATURE-----
--WetXT0Y5FME7H
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#6 |
Daniel Stone's "understanding" about who is "handling 4.3" is wrong -- I'm
not sure where he got it, as I've discussed this issue with Martin Schulze
from the Debian Security Team and Fabio Massimo Di Nitto, the XFree86
package release manager.
Fabio is handling 4.3.0.dfsg.1-8, as he has handled all but one of the
recent XFree86 uploads to unstable.
I have handled 4.1.0-16woody4 by delivering security-fixed packages to the
Debian Security Team on Saturday, 18 September.
(In the future, please don't file bugs against unsupported or unreleased
versions of Debian packages. I have no idea what libxpm4
"4.3.0-
proper recipient of your bug report.)
--
G. Branden Robinson | Religious bondage shackles and
Debian GNU/Linux | debilitates the mind and unfits it
<email address hidden> | for every noble enterprise.
http://
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #7 |
Message-ID: <email address hidden>
Date: Mon, 20 Sep 2004 15:14:18 -0500
From: Branden Robinson <email address hidden>
To: <email address hidden>
Cc: <email address hidden>
Subject: libxpm4 security problem
--9JSHP372f+2dzJ8X
Content-Type: text/plain; charset=us-ascii
Content-
Content-
Daniel Stone's "understanding" about who is "handling 4.3" is wrong -- I'm
not sure where he got it, as I've discussed this issue with Martin Schulze
=66rom the Debian Security Team and Fabio Massimo Di Nitto, the XFree86
package release manager.
Fabio is handling 4.3.0.dfsg.1-8, as he has handled all but one of the
recent XFree86 uploads to unstable.
I have handled 4.1.0-16woody4 by delivering security-fixed packages to the
Debian Security Team on Saturday, 18 September.
(In the future, please don't file bugs against unsupported or unreleased
versions of Debian packages. I have no idea what libxpm4
"4.3.0-
proper recipient of your bug report.)
--=20
G. Branden Robinson | Religious bondage shackles and
Debian GNU/Linux | debilitates the mind and unfits it
<email address hidden> | for every noble enterprise.
http://
--9JSHP372f+2dzJ8X
Content-Type: application/
Content-
Content-
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iEYEARECAAYFAkF
G3IAn3q5cjxU6VZ
=ksHV
-----END PGP SIGNATURE-----
--9JSHP372f+
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#8 |
Branden Robinson wrote:
> (In the future, please don't file bugs against unsupported or unreleased
> versions of Debian packages. I have no idea what libxpm4
> "4.3.0-
> proper recipient of your bug report.)
It's an internal versioning scheme, sorry for the confusion. I checked
it against sid, although it has been sent off a machine running the
above version.
Cheers,
Moritz
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #9 |
Message-Id: <email address hidden>
Date: Tue, 21 Sep 2004 08:44:10 +0200
From: Moritz =?ISO-8859-
To: Branden Robinson <email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#272493: libxpm4 security problem
Branden Robinson wrote:
> (In the future, please don't file bugs against unsupported or unreleased
> versions of Debian packages. I have no idea what libxpm4
> "4.3.0-
> proper recipient of your bug report.)
It's an internal versioning scheme, sorry for the confusion. I checked
it against sid, although it has been sent off a machine running the
above version.
Cheers,
Moritz
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#10 |
On Mon, Sep 20, 2004 at 03:14:18PM -0500, Branden Robinson wrote:
> Daniel Stone's "understanding" about who is "handling 4.3" is wrong -- I'm
> not sure where he got it, as I've discussed this issue with Martin Schulze
> from the Debian Security Team and Fabio Massimo Di Nitto, the XFree86
> package release manager.
Apologies for the misunderstanding.
> [...]
>
> (In the future, please don't file bugs against unsupported or unreleased
> versions of Debian packages. I have no idea what libxpm4
> "4.3.0-
> proper recipient of your bug report.)
Ehm, while it's a decent general rule, the bug here clearly applies to
all versions of XFree86, so there's no reason to tell them to go file
a bug report somewhere else. Both you and I know that the version
header is irrelevant in this case.
--
Daniel Stone <email address hidden>
Debian: the universal operating system http://
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #11 |
Message-ID: <email address hidden>
Date: Sat, 25 Sep 2004 21:35:47 -0700
From: Daniel Stone <email address hidden>
To: Branden Robinson <email address hidden>,
<email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#272493: libxpm4 security problem
--it/zdz3K1bH9Y8/E
Content-Type: text/plain; charset=us-ascii
Content-
Content-
On Mon, Sep 20, 2004 at 03:14:18PM -0500, Branden Robinson wrote:
> Daniel Stone's "understanding" about who is "handling 4.3" is wrong -- I'm
> not sure where he got it, as I've discussed this issue with Martin Schulze
> from the Debian Security Team and Fabio Massimo Di Nitto, the XFree86
> package release manager.
Apologies for the misunderstanding.
> [...]
>=20
> (In the future, please don't file bugs against unsupported or unreleased
> versions of Debian packages. I have no idea what libxpm4
> "4.3.0-
> proper recipient of your bug report.)
Ehm, while it's a decent general rule, the bug here clearly applies to
all versions of XFree86, so there's no reason to tell them to go file
a bug report somewhere else. Both you and I know that the version
header is irrelevant in this case.
--=20
Daniel Stone <daniels@debian=
=2Eorg>
Debian: the universal operating system http://
n.org
--it/zdz3K1bH9Y8/E
Content-Type: application/
Content-
Content-
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iD8DBQFBVkcjcPC
ajhqCH5E1W+
=cQbq
-----END PGP SIGNATURE-----
--it/zdz3K1bH9Y
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#12 |
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
tag 272493 pending
stop
- --
<user> fajita: step one
<fajita> Whatever the problem, step one is always to look in the error log.
<user> fajita: step two
<fajita> When in danger or in doubt, step two is to scream and shout.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://
iD8DBQFBV7ayhCz
q78yH86cj21LTIM
=u+SL
-----END PGP SIGNATURE-----
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #13 |
Message-ID: <email address hidden>
Date: Mon, 27 Sep 2004 08:44:04 +0200
From: Fabio Massimo Di Nitto <email address hidden>
To: <email address hidden>
Subject: Tagging
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
tag 272493 pending
stop
- --
<user> fajita: step one
<fajita> Whatever the problem, step one is always to look in the error log.
<user> fajita: step two
<fajita> When in danger or in doubt, step two is to scream and shout.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://
iD8DBQFBV7ayhCz
q78yH86cj21LTIM
=u+SL
-----END PGP SIGNATURE-----
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#14 |
On Tue, Sep 21, 2004 at 08:44:10AM +0200, Moritz Mühlenhoff wrote:
> Branden Robinson wrote:
> > (In the future, please don't file bugs against unsupported or unreleased
> > versions of Debian packages. I have no idea what libxpm4
> > "4.3.0-
> > proper recipient of your bug report.)
>
> It's an internal versioning scheme, sorry for the confusion. I checked
> it against sid, although it has been sent off a machine running the
> above version.
You can edit the reported version number, of course.
I'm just trying to reinforce a good habit -- I'm aware that pretty much
every version of libXpm ever released has this flaw.
However, many bugs reported against XFree86 don't have such universal
applicability, so I attempt to reinforce sound bug-reporting practices. :)
--
G. Branden Robinson | It may be difficult to to determine
Debian GNU/Linux | where religious beliefs end and
<email address hidden> | mental illness begins.
http://
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
Debian Bug Importer (debzilla) wrote : | #15 |
Message-ID: <email address hidden>
Date: Mon, 27 Sep 2004 17:26:06 -0500
From: Branden Robinson <email address hidden>
To: <email address hidden>
Subject: Re: Bug#272493: libxpm4 security problem
--n2Pv11Ogg/Ox8ay5
Content-Type: text/plain; charset=iso-8859-1
Content-
Content-
On Tue, Sep 21, 2004 at 08:44:10AM +0200, Moritz M=FChlenhoff wrote:
> Branden Robinson wrote:
> > (In the future, please don't file bugs against unsupported or unreleased
> > versions of Debian packages. I have no idea what libxpm4
> > "4.3.0-
> > proper recipient of your bug report.)
>=20
> It's an internal versioning scheme, sorry for the confusion. I checked
> it against sid, although it has been sent off a machine running the
> above version.
You can edit the reported version number, of course.
I'm just trying to reinforce a good habit -- I'm aware that pretty much
every version of libXpm ever released has this flaw.
However, many bugs reported against XFree86 don't have such universal
applicability, so I attempt to reinforce sound bug-reporting practices. :)
--=20
G. Branden Robinson | It may be difficult to to determine
Debian GNU/Linux | where religious beliefs end and
<email address hidden> | mental illness begins.
http://
--n2Pv11Ogg/Ox8ay5
Content-Type: application/
Content-
Content-
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iEYEARECAAYFAkF
EzQAoIqDoyi3Zh0
=1s6T
-----END PGP SIGNATURE-----
--n2Pv11Ogg/
![](/+icing/build/overlay/assets/skins/sam/images/close.gif)
|
#16 |
Source: xfree86
Source-Version: 4.3.0.dfsg.1-8
We believe that the bug you reported is fixed in the latest version of
xfree86, which is due to be installed in the Debian FTP archive:
lbxproxy_
to pool/main/
libdps-
to pool/main/
libdps1-
to pool/main/
libdps1_
to pool/main/
libice-
to pool/main/
libice6-
to pool/main/
libice6_
to pool/main/
libsm-dev_
to pool/main/
libsm6-
to pool/main/
libsm6_
to pool/main/
libx11-
to pool/main/
libx11-
to pool/main/
libx11-
to pool/main/
libxaw6-
to pool/main/
libxaw6-
to pool/main/
libxaw6_
to pool/main/
libxaw7-
to pool/main/
libxaw7-
to pool/main/
libxaw7_
to pool/main/
libxext-
to pool/main/
libxext6-
to pool/main/
libxext6_
to pool/main/
libxft1-
to pool/main/
libxft1_
to pool/main/
libxi-dev_
to pool/main/
libxi6-
to pool/main/
libxi6_
to pool/main/
libxmu-
to pool/main/
libxmu6-
to pool/main/
libxmu6_
to pool/main/
libxmuu-
to pool/main/
libxmuu1-
to pool/main/
libxmuu1_4....
Changed in libxpm: | |
status: | Unknown → Fix Released |
Automatically imported from Debian bug report #272493 http:// bugs.debian. org/272493