漏洞信息详情
libpng逐行读取远程整数溢出漏洞
- CNNVD编号:CNNVD-200411-087
- 危害等级: 中危
- CVE编号:
CVE-2004-0599
- 漏洞类型:
未知
- 发布时间:
2004-07-12
- 威胁类型:
远程
- 更新时间:
2010-04-02
- 厂 商:
greg_roelofs - 漏洞来源:
chris chris@cr-sec… -
漏洞简介
libpng是多种应用程序使用的解析PNG图象格式的库。
libpng逐行读取PNG图象时存在整数溢出问题,远程攻击者可以利用这个漏洞对应用程序进行拒绝服务攻击。
libpng库提供隔行或者逐行显示PNG图象的功能,在处理逐行显示图象时存在多个整数溢出。
攻击者可以构建恶意PNG文件,诱使用户解析,可能导致应用程序崩溃。
漏洞公告
厂商补丁:
libpng
——
使用如下补丁程序:
diff -ru libpng-1.2.5/png.h libpng-1.2.5.fix/png.h
— libpng-1.2.5/png.h 2002-10-03 12:32:26.000000000 +0100
+++ libpng-1.2.5.fix/png.h 2004-07-13 23:18:10.000000000 +0100
@@ -835,6 +835,9 @@
/* Maximum positive integer used in PNG is (2^31)-1 */
#define PNG_MAX_UINT ((png_uint_32)0x7fffffffL)
+/* Constraints on width, height, (2 ^ 24) – 1*/
+#define PNG_MAX_DIMENSION 16777215
+
/* These describe the color_type field in png_info. */
/* color type masks */
#define PNG_COLOR_MASK_PALETTE 1
diff -ru libpng-1.2.5/pngpread.c libpng-1.2.5.fix/pngpread.c
— libpng-1.2.5/pngpread.c 2002-10-03 12:32:28.000000000 +0100
+++ libpng-1.2.5.fix/pngpread.c 2004-07-13 23:03:58.000000000 +0100
@@ -209,6 +209,8 @@
png_push_fill_buffer(png_ptr, chunk_length, 4);
png_ptr->push_length = png_get_uint_32(chunk_length);
+ if (png_ptr->push_length > PNG_MAX_UINT)
+ png_error(png_ptr, “Invalid chunk length.”);
png_reset_crc(png_ptr);
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;
@@ -638,6 +640,8 @@
png_push_fill_buffer(png_ptr, chunk_length, 4);
png_ptr->push_length = png_get_uint_32(chunk_length);
+ if (png_ptr->push_length > PNG_MAX_UINT)
+ png_error(png_ptr, “Invalid chunk length.”);
png_reset_crc(png_ptr);
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
diff -ru libpng-1.2.5/pngrutil.c libpng-1.2.5.fix/pngrutil.c
— libpng-1.2.5/pngrutil.c 2004-07-13 13:36:37.000000000 +0100
+++ libpng-1.2.5.fix/pngrutil.c 2004-07-13 23:43:02.000000000 +0100
@@ -350,7 +350,11 @@
png_crc_finish(png_ptr, 0);
width = png_get_uint_32(buf);
+ if (width > PNG_MAX_DIMENSION)
+ png_error(png_ptr, “Width is too large”);
height = png_get_uint_32(buf + 4);
+ if (height > PNG_MAX_DIMENSION)
+ png_error(png_ptr, “Height is too large”);
bit_depth = buf[8];
color_type = buf[9];
compression_type = buf[10];
@@ -675,7 +679,7 @@
else
truelen = (png_size_t)png_ptr->channels;
– if (length != truelen)
+ if (length != truelen || length > 4)
{
png_warning(png_ptr, “Incorrect sBIT chunk length”);
png_crc_finish(png_ptr, length);
@@ -1244,7 +1248,8 @@
/* Should be an error, but we can cope with it */
png_warning(png_ptr, “Missing PLTE before tRNS”);
}
– else if (length > (png_uint_32)png_ptr->num_palette)
+ if (length > (png_uint_32)png_ptr->num_palette ||
+ length > PNG_MAX_PALETTE_LENGTH)
{
png_warning(png_ptr, “Incorrect tRNS chunk length”);
png_crc_finish(png_ptr, length);
@@ -1400,7 +1405,7 @@
void /* PRIVATE */
png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)
{
– int num, i;
+ unsigned int num, i;
png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];
png_debug(1, “in png_handle_hIST\n”);
@@ -1426,8 +1431,8 @@
return;
}
– num = (int)length / 2 ;
– if (num != png_ptr->num_palette)
+ num = length / 2 ;
+ if (num != png_ptr->num_palette || num > PNG_MAX_PALETTE_LENGTH)
{
png_warning(png_ptr, “Incorrect hIST chunk length”);
png_crc_finish(png_ptr, length);
@@ -2868,6 +2873,9 @@
png_read_data(png_ptr, chunk_length, 4);
png_ptr->idat_size = png_get_uint_32(chunk_length);
+ if (png_ptr->idat_size > PNG_MAX_UINT)
+ png_error(png_ptr, “Invalid chunk length.”);
+
png_reset_crc(png_ptr);
png_crc_read(png_ptr, png_ptr->chunk_name, 4);
if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4))
参考网址
来源:US-CERT Technical Alert: TA04-217A
名称: TA04-217A
链接:http://www.us-cert.gov/cas/techalerts/TA04-217A.html
来源:US-CERT Vulnerability Note: VU#477512
名称: VU#477512
链接:http://www.kb.cert.org/vuls/id/477512
来源:US-CERT Vulnerability Note: VU#286464
名称: VU#286464
链接:http://www.kb.cert.org/vuls/id/286464
来源:US-CERT Vulnerability Note: VU#160448
名称: VU#160448
链接:http://www.kb.cert.org/vuls/id/160448
来源: FEDORA
名称: FLSA:1943
链接:https://bugzilla.fedora.us/show_bug.cgi?id=1943
来源: BID
名称: 10857
链接:http://www.securityfocus.com/bid/10857
来源: SUSE
名称: SUSE-SA:2004:023
链接:http://www.novell.com/linux/security/advisories/2004_23_libpng.html
来源: GENTOO
名称: GLSA-200408-22
链接:http://www.gentoo.org/security/en/glsa/glsa-200408-22.xml
来源: GENTOO
名称: GLSA-200408-03
链接:http://www.gentoo.org/security/en/glsa/glsa-200408-03.xml
来源: DEBIAN
名称: DSA-571
链接:http://www.debian.org/security/2004/dsa-571
来源: DEBIAN
名称: DSA-570
链接:http://www.debian.org/security/2004/dsa-570
来源: DEBIAN
名称: DSA-536
链接:http://www.debian.org/security/2004/dsa-536
来源: FEDORA
名称: FLSA:2089
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109900315219363&w=2
来源: SCO
名称: SCOSA-2004.16
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109761239318458&w=2
来源: HP
名称: SSRT4778
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109181639602978&w=2
来源: BUGTRAQ
名称: 20040804 [OpenPKG-SA-2004.035] OpenPKG Security Advisory (png)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109163866717909&w=2
来源: XF
名称: lilbpng-integer-bo(16896)
链接:http://xforce.iss.net/xforce/xfdb/16896
来源: TRUSTIX
名称: 2004-0040
链接:http://www.trustix.net/errata/2004/0040/
来源: BID
名称: 15495
链接:http://www.securityfocus.com/bid/15495
来源: REDHAT
名称: RHSA-2004:429
链接:http://www.redhat.com/support/errata/RHSA-2004-429.html
来源: REDHAT
名称: RHSA-2004:421
链接:http://www.redhat.com/support/errata/RHSA-2004-421.html
来源: REDHAT
名称: RHSA-2004:402
链接:http://www.redhat.com/support/errata/RHSA-2004-402.html
来源: www.mozilla.org
链接:http://www.mozilla.org/projects/security/known-vulnerabilities.html
来源: scary.beasts.org
链接:http://scary.beasts.org/security/CESA-2004-001.txt
来源: OVAL
名称: oval:org.mitre.oval:def:10938
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10938
来源: APPLE
名称: APPLE-SA-2004-09-09
链接:http://lists.apple.com/mhonarc/security-announce/msg00056.html
来源: CONECTIVA
名称: CLA-2004:856
链接:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856
来源: SCO
名称: SCOSA-2005.49
链接:ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt
来源: MANDRIVA
名称: MDKSA-2006:213
链接:http://www.mandriva.com/security/advisories?name=MDKSA-2006:213
来源: MANDRIVA
名称: MDKSA-2006:212
链接:http://www.mandriva.com/security/advisories?name=MDKSA-2006:212
来源: MANDRAKE
名称: MDKSA-2004:079
链接:http://www.mandriva.com/security/advisories?name=MDKSA-2004:079
来源: SUNALERT
名称: 200663
链接:http://sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1
来源: SECUNIA
名称: 22958
链接:http://secunia.com/advisories/22958
来源: SECUNIA
名称: 22957
链接:http://secunia.com/advisories/22957
来源: US Government Resource: oval:org.mitre.oval:def:1479
名称: oval:org.mitre.oval:def:1479
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1479