libpng逐行读取远程整数溢出漏洞

漏洞信息详情

libpng逐行读取远程整数溢出漏洞

漏洞简介

libpng是多种应用程序使用的解析PNG图象格式的库。
libpng逐行读取PNG图象时存在整数溢出问题,远程攻击者可以利用这个漏洞对应用程序进行拒绝服务攻击。
libpng库提供隔行或者逐行显示PNG图象的功能,在处理逐行显示图象时存在多个整数溢出。
攻击者可以构建恶意PNG文件,诱使用户解析,可能导致应用程序崩溃。

漏洞公告

厂商补丁:
libpng
——
使用如下补丁程序:

diff -ru libpng-1.2.5/png.h libpng-1.2.5.fix/png.h

— libpng-1.2.5/png.h 2002-10-03 12:32:26.000000000 +0100

+++ libpng-1.2.5.fix/png.h 2004-07-13 23:18:10.000000000 +0100

@@ -835,6 +835,9 @@

/* Maximum positive integer used in PNG is (2^31)-1 */

#define PNG_MAX_UINT ((png_uint_32)0x7fffffffL)

+/* Constraints on width, height, (2 ^ 24) – 1*/

+#define PNG_MAX_DIMENSION 16777215

+

/* These describe the color_type field in png_info. */

/* color type masks */

#define PNG_COLOR_MASK_PALETTE 1

diff -ru libpng-1.2.5/pngpread.c libpng-1.2.5.fix/pngpread.c

— libpng-1.2.5/pngpread.c 2002-10-03 12:32:28.000000000 +0100

+++ libpng-1.2.5.fix/pngpread.c 2004-07-13 23:03:58.000000000 +0100

@@ -209,6 +209,8 @@

png_push_fill_buffer(png_ptr, chunk_length, 4);

png_ptr->push_length = png_get_uint_32(chunk_length);

+ if (png_ptr->push_length > PNG_MAX_UINT)

+ png_error(png_ptr, “Invalid chunk length.”);

png_reset_crc(png_ptr);

png_crc_read(png_ptr, png_ptr->chunk_name, 4);

png_ptr->mode |= PNG_HAVE_CHUNK_HEADER;

@@ -638,6 +640,8 @@

png_push_fill_buffer(png_ptr, chunk_length, 4);

png_ptr->push_length = png_get_uint_32(chunk_length);

+ if (png_ptr->push_length > PNG_MAX_UINT)

+ png_error(png_ptr, “Invalid chunk length.”);

png_reset_crc(png_ptr);

png_crc_read(png_ptr, png_ptr->chunk_name, 4);

diff -ru libpng-1.2.5/pngrutil.c libpng-1.2.5.fix/pngrutil.c

— libpng-1.2.5/pngrutil.c 2004-07-13 13:36:37.000000000 +0100

+++ libpng-1.2.5.fix/pngrutil.c 2004-07-13 23:43:02.000000000 +0100

@@ -350,7 +350,11 @@

png_crc_finish(png_ptr, 0);

width = png_get_uint_32(buf);

+ if (width > PNG_MAX_DIMENSION)

+ png_error(png_ptr, “Width is too large”);

height = png_get_uint_32(buf + 4);

+ if (height > PNG_MAX_DIMENSION)

+ png_error(png_ptr, “Height is too large”);

bit_depth = buf[8];

color_type = buf[9];

compression_type = buf[10];

@@ -675,7 +679,7 @@

else

truelen = (png_size_t)png_ptr->channels;

– if (length != truelen)

+ if (length != truelen || length > 4)

{

png_warning(png_ptr, “Incorrect sBIT chunk length”);

png_crc_finish(png_ptr, length);

@@ -1244,7 +1248,8 @@

/* Should be an error, but we can cope with it */

png_warning(png_ptr, “Missing PLTE before tRNS”);

}

– else if (length > (png_uint_32)png_ptr->num_palette)

+ if (length > (png_uint_32)png_ptr->num_palette ||

+ length > PNG_MAX_PALETTE_LENGTH)

{

png_warning(png_ptr, “Incorrect tRNS chunk length”);

png_crc_finish(png_ptr, length);

@@ -1400,7 +1405,7 @@

void /* PRIVATE */

png_handle_hIST(png_structp png_ptr, png_infop info_ptr, png_uint_32 length)

{

– int num, i;

+ unsigned int num, i;

png_uint_16 readbuf[PNG_MAX_PALETTE_LENGTH];

png_debug(1, “in png_handle_hIST\n”);

@@ -1426,8 +1431,8 @@

return;

}

– num = (int)length / 2 ;

– if (num != png_ptr->num_palette)

+ num = length / 2 ;

+ if (num != png_ptr->num_palette || num > PNG_MAX_PALETTE_LENGTH)

{

png_warning(png_ptr, “Incorrect hIST chunk length”);

png_crc_finish(png_ptr, length);

@@ -2868,6 +2873,9 @@

png_read_data(png_ptr, chunk_length, 4);

png_ptr->idat_size = png_get_uint_32(chunk_length);

+ if (png_ptr->idat_size > PNG_MAX_UINT)

+ png_error(png_ptr, “Invalid chunk length.”);

+

png_reset_crc(png_ptr);

png_crc_read(png_ptr, png_ptr->chunk_name, 4);

if (png_memcmp(png_ptr->chunk_name, (png_bytep)png_IDAT, 4))

参考网址

来源:US-CERT Technical Alert: TA04-217A
名称: TA04-217A
链接:http://www.us-cert.gov/cas/techalerts/TA04-217A.html

来源:US-CERT Vulnerability Note: VU#477512
名称: VU#477512
链接:http://www.kb.cert.org/vuls/id/477512

来源:US-CERT Vulnerability Note: VU#286464
名称: VU#286464
链接:http://www.kb.cert.org/vuls/id/286464

来源:US-CERT Vulnerability Note: VU#160448
名称: VU#160448
链接:http://www.kb.cert.org/vuls/id/160448

来源: FEDORA
名称: FLSA:1943
链接:https://bugzilla.fedora.us/show_bug.cgi?id=1943

来源: BID
名称: 10857
链接:http://www.securityfocus.com/bid/10857

来源: SUSE
名称: SUSE-SA:2004:023
链接:http://www.novell.com/linux/security/advisories/2004_23_libpng.html

来源: GENTOO
名称: GLSA-200408-22
链接:http://www.gentoo.org/security/en/glsa/glsa-200408-22.xml

来源: GENTOO
名称: GLSA-200408-03
链接:http://www.gentoo.org/security/en/glsa/glsa-200408-03.xml

来源: DEBIAN
名称: DSA-571
链接:http://www.debian.org/security/2004/dsa-571

来源: DEBIAN
名称: DSA-570
链接:http://www.debian.org/security/2004/dsa-570

来源: DEBIAN
名称: DSA-536
链接:http://www.debian.org/security/2004/dsa-536

来源: FEDORA
名称: FLSA:2089
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109900315219363&w=2

来源: SCO
名称: SCOSA-2004.16
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109761239318458&w=2

来源: HP
名称: SSRT4778
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109181639602978&w=2

来源: BUGTRAQ
名称: 20040804 [OpenPKG-SA-2004.035] OpenPKG Security Advisory (png)
链接:http://marc.theaimsgroup.com/?l=bugtraq&m=109163866717909&w=2

来源: XF
名称: lilbpng-integer-bo(16896)
链接:http://xforce.iss.net/xforce/xfdb/16896

来源: TRUSTIX
名称: 2004-0040
链接:http://www.trustix.net/errata/2004/0040/

来源: BID
名称: 15495
链接:http://www.securityfocus.com/bid/15495

来源: REDHAT
名称: RHSA-2004:429
链接:http://www.redhat.com/support/errata/RHSA-2004-429.html

来源: REDHAT
名称: RHSA-2004:421
链接:http://www.redhat.com/support/errata/RHSA-2004-421.html

来源: REDHAT
名称: RHSA-2004:402
链接:http://www.redhat.com/support/errata/RHSA-2004-402.html

来源: www.mozilla.org
链接:http://www.mozilla.org/projects/security/known-vulnerabilities.html

来源: scary.beasts.org
链接:http://scary.beasts.org/security/CESA-2004-001.txt

来源: OVAL
名称: oval:org.mitre.oval:def:10938
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10938

来源: APPLE
名称: APPLE-SA-2004-09-09
链接:http://lists.apple.com/mhonarc/security-announce/msg00056.html

来源: CONECTIVA
名称: CLA-2004:856
链接:http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856

来源: SCO
名称: SCOSA-2005.49
链接:ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txt

来源: MANDRIVA
名称: MDKSA-2006:213
链接:http://www.mandriva.com/security/advisories?name=MDKSA-2006:213

来源: MANDRIVA
名称: MDKSA-2006:212
链接:http://www.mandriva.com/security/advisories?name=MDKSA-2006:212

来源: MANDRAKE
名称: MDKSA-2004:079
链接:http://www.mandriva.com/security/advisories?name=MDKSA-2004:079

来源: SUNALERT
名称: 200663
链接:http://sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1

来源: SECUNIA
名称: 22958
链接:http://secunia.com/advisories/22958

来源: SECUNIA
名称: 22957
链接:http://secunia.com/advisories/22957

来源: US Government Resource: oval:org.mitre.oval:def:1479
名称: oval:org.mitre.oval:def:1479
链接:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:1479

受影响实体

© 版权声明
THE END
喜欢就支持一下吧
点赞0 分享