漏洞信息详情
libpng逐行读取远程整数溢出漏洞
- CNNVD编号：CNNVD-200411-087
- 危害等级： 低危
- CVE编号： CVE-2004-0599
- 漏洞类型： 未知
- 发布时间： 2004-07-12
- 威胁类型： 远程
- 更新时间： 2010-04-02
- 厂 商： greg_roelofs
- 漏洞来源： chris chris@cr-sec...
漏洞简介
libpng是多种应用程序使用的解析PNG图象格式的库。 libpng逐行读取PNG图象时存在整数溢出问题，远程攻击者可以利用这个漏洞对应用程序进行拒绝服务攻击。 libpng库提供隔行或者逐行显示PNG图象的功能，在处理逐行显示图象时存在多个整数溢出。 攻击者可以构建恶意PNG文件，诱使用户解析，可能导致应用程序崩溃。
漏洞公告
厂商补丁： libpng ------ 使用如下补丁程序：
diff -ru libpng-1.2.5/png.h libpng-1.2.5.fix/png.h
--- libpng-1.2.5/png.h 2002-10-03 12:32:26.000000000 +0100
+++ libpng-1.2.5.fix/png.h 2004-07-13 23:18:10.000000000 +0100
@@ -835,6 +835,9 @@
/* Maximum positive integer used in PNG is (2^31)-1 */
#define PNG_MAX_UINT ((png_uint_32)0x7fffffffL)
+/* Constraints on width, height, (2 ^ 24) - 1*/
+#define PNG_MAX_DIMENSION 16777215
+
/* These describe the color_type field in png_info. */
/* color type masks */
#define PNG_COLOR_MASK_PALETTE 1
diff -ru libpng-1.2.5/pngpread.c libpng-1.2.5.fix/pngpread.c
--- libpng-1.2.5/pngpread.c 2002-10-03 12:32:28.000000000 +0100
+++ libpng-1.2.5.fix/pngpread.c 2004-07-13 23:03:58.000000000 +0100
@@ -209,6 +209,8 @@
png_push_fill_buffer(png_ptr, chunk_length, 4);
png_ptr->push_length = png_get_uint_32(chunk_length);
+ if (png_ptr->push_length > PNG_MAX_UINT)
+ png_error(png_ptr, "Invalid chunk length.");
png_reset_crc(png_ptr);
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
@@ -638,6 +640,8 @@
png_push_fill_buffer(png_ptr, chunk_length, 4);
png_ptr->push_length = png_get_uint_32(chunk_length);
+ if (png_ptr->push_length > PNG_MAX_UINT)
+ png_error(png_ptr, "Invalid chunk length.");
png_reset_crc(png_ptr);
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
diff -ru libpng-1.2.5/pngrutil.c libpng-1.2.5.fix/pngrutil.c
--- libpng-1.2.5/pngrutil.c 2004-07-13 13:36:37.000000000 +0100
+++ libpng-1.2.5.fix/pngrutil.c 2004-07-13 23:43:02.000000000 +0100
@@ -350,7 +350,11 @@
png_crc_finish(png_ptr, 0);
width = png_get_uint_32(buf);
+ if (width > PNG_MAX_DIMENSION)
+ png_error(png_ptr, "Width is too large");
height = png_get_uint_32(buf + 4);
+ if (height > PNG_MAX_DIMENSION)
+ png_error(png_ptr, "Height is too large");
bit_depth = buf[8];
color_type = buf[9];
compression_type = buf[10];
@@ -675,7 +679,7 @@
else
truelen = (png_size_t)png_ptr->channels;
- if (length != truelen)
+ if (length != truelen || length > 4)
{
png_warning(png_ptr, "Incorrect sBIT chunk length");
png_crc_finish(png_ptr, length);
@@ -1244,7 +1248,8 @@
/* Should be an error, but we can cope with it */
png_warning(png_ptr, "Missing PLTE before tRNS");
}
- else if (length > (png_uint_32)png_ptr->num_palette)
+ if (length > (png_uint_32)png_ptr->num_palette ||
+ length > PNG_MAX_PALETTE_LENGTH)
{
png_warning(png_ptr, "Incorrect tRNS chunk length");
png_crc_finish(png_ptr, length);
@@ -1400,7 +1405,7 @@
void /* PRIVATE */
png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
{
- int num, i;
+ unsigned int num, i;
png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
png_debug(1, "in png_handle_hIST\n");
@@ -1426,8 +1431,8 @@
return;
}
- num = (int)length / 2 ;
- if (num != png_ptr->num_palette)
+ num = length / 2 ;
+ if (num != png_ptr->num_palette || num > PNG_MAX_PALETTE_LENGTH)
{
png_warning(png_ptr, "Incorrect hIST chunk length");
png_crc_finish(png_ptr, length);
@@ -2868,6 +2873,9 @@
png_read_data(png_ptr, chunk_length, 4);
png_ptr->idat_size = png_get_uint_32(chunk_length);
+ if (png_ptr->idat_size > PNG_MAX_UINT)
+ png_error(png_ptr, "Invalid chunk length.");
+
png_reset_crc(png_ptr);
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4))
参考网址
来源:US-CERT Technical Alert: TA04-217A 名称: TA04-217A 链接:http://www.us-cert.gov/cas/techalerts/TA04-217A.HTML 来源:US-CERT Vulnerability Note: VU#477512 名称: VU#477512 链接:http://www.kb.cert.org/vuls/id/477512 来源:US-CERT Vulnerability Note: VU#286464 名称: VU#286464 链接:http://www.kb.cert.org/vuls/id/286464 来源:US-CERT Vulnerability Note: VU#160448 名称: VU#160448 链接:http://www.kb.cert.org/vuls/id/160448 来源: FEDORA 名称: FLSA:1943 链接:https://bugzilla.fedora.us/show_bug.cgi?id=1943 来源: BID 名称: 10857 链接:http://www.securityfocus.com/bid/10857 来源: SUSE 名称: SUSE-SA:2004:023 链接:http://www.novell.com/linux/security/advisories/2004_23_libpng.HTML 来源: GENTOO 名称: GLSA-200408-22 链接:http://www.gentoo.org/security/en/glsa/glsa-200408-22.xml 来源: GENTOO 名称: GLSA-200408-03 链接:http://www.gentoo.org/security/en/glsa/glsa-200408-03.xml 来源: DEBIAN 名称: DSA-571 链接:http://www.debian.org/security/2004/dsa-571 来源: DEBIAN 名称: DSA-570 链接:http://www.debian.org/security/2004/dsa-570 来源: DEBIAN 名称: DSA-536 链接:http://www.debian.org/security/2004/dsa-536 来源: FEDORA 名称: FLSA:2089 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109900315219363&w=2 来源: SCO 名称: SCOSA-2004.16 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109761239318458&w=2 来源: HP 名称: SSRT4778 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109181639602978&w=2 来源: BUGTRAQ 名称: 20040804 [OpenPKG-SA-2004.035] OpenPKG Security Advisory (png) 链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109163866717909&w=2 来源: XF 名称: lilbpng-integer-bo(16896) 链接:http://xforce.iss.net/xforce/xfdb/16896 来源: TRUSTIX 名称: 2004-0040 链接:http://www.trustix.net/errata/2004/0040/ 来源: BID 名称: 15495 链接:http://www.securityfocus.com/bid/15495 来源: REDHAT 名称: RHSA-2004:429 链接:http://www.redhat.com/support/errata/RHSA-2004-429.HTML 来源: REDHAT 名称: RHSA-2004:421 链接:http://www.redhat.com/support/errata/RHSA-2004-421.HTML 来源: REDHAT 名称: RHSA-2004:402 链接:http://www.redhat.com/support/errata/RHSA-2004-402.HTML 来源: www.mozilla.org 链接:http://www.mozilla.org/projects/security/known-vulnerabilities.HTML 来源: scary.beasts.org 链接:http://scary.beasts.org/security/CESA-2004-001.txt 来源: OVAL 名称: oval:org.mitre.oval:def:10938 链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10938 来源: CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple 名称: CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple-SA-2004-09-09 链接:http://lists.CMS.zone.ci/e/tags/htag.php?tag=Apple target=_blank class=infotextkey>Apple.com/mhonarc/security-announce/msg00056.HTML 来源: CONECTIVA 名称: CLA-2004:856 链接:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856 来源: SCO 名称: SCOSA-2005.49 链接:ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt 来源: MANDRIVA 名称: MDKSA-2006:213 链接:http://www.mandriva.com/security/advisories?name=MDKSA-2006:213 来源: MANDRIVA 名称: MDKSA-2006:212 链接:http://www.mandriva.com/security/advisories?name=MDKSA-2006:212 来源: MANDRAKE 名称: MDKSA-2004:079 链接:http://www.mandriva.com/security/advisories?name=MDKSA-2004:079 来源: SUNALERT 名称: 200663 链接:http://sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1 来源: SECUNIA 名称: 22958 链接:http://secunia.com/advisories/22958 来源: SECUNIA 名称: 22957 链接:http://secunia.com/advisories/22957 来源: US Government Resource: oval:org.mitre.oval:def:1479 名称: oval:org.mitre.oval:def:1479 链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1479
受影响实体
- Greg_roelofs Libpng:1.2.5
补丁
暂无
评论