Slashdot Mirror
CERT Warns Of Multiple Vulnerabilities In Libpng
jefftp writes "CERT announced today that there are several vulnerabilities in libpng, one is a buffer overflow which could potentially cause a PNG image file to execute arbitrary code. Libpng release 1.2.6rc1 addresses the problems covered by this CERT announcement, and can be obtained from the libpng Sourceforge project. A fully tested version is to be released in the next few weeks."
Yes. Most everything on Linux that reads or writes PNG's uses it.
'Standards' in computing only impress those who are impressed by things like 'standards'.
New builds of Mozilla / Firefox / Thunderbird have been released to patch four potential security vulnerabilities including the libpng issue
I know its a joke, but it seems to work in IE as well, or at least an example PNG crashes it, i suppose one could be crafted for IE to exploit it.
Fedora Core 1 and 2 already have backported security updates for this as 1.2.5-7 and 1.2.5-8 respectively since yesterday. Much better than having to install a release candidate.
It's like deja vu all over again.
According to this, libpng is part of the source tree. My guess is static.
M$ Lawyer: But `gcc
Well, _lib_png have many, many jmp like instructions, they're called
function calls, and if you manage to overwrite the return address on the stack, you can make it jump anywhere, like the code you injected.
Hopefully it's just the stack you can overflow, most of us should run with a no executable stack theses days, no harm done(well, it probably crashes.. )
"And how many PHP sites/scripts dynamically generates .png files ? Quite a lot I'd think, so, webservers might be vunerable, but it seems
like a longshot to try to inject something to such scripts."
Did you read the article? You don't seem to understand the point here.
The bug affects only loading of PNG images. One can make a specially crafted PNG image which has some invalid fields causing problems in the decoder. The invalid handling of these special error cases may cause an application crash or potential execution of arbitary code in the application which uses libpng.
It is not possible to introduce malicious RAW image data to the encoder. And even if it was possible, you should be able to pump data directly in the encoder, which is not a usual case with dynamically generated images. So, your PHP site is safe.
However, libpng is the most commonly used PNG implementation due to it's free licence. These bugs affect to very many applications (graphics applications, Office applications, user interface managers, browsers, etc.) which happen to use PNG.
A similiar case like this was zlib bugs some time ago.
Yeah it's still not fixed, but when an updated package is available it will still most likely simply be versioned 1.2.5-r8. You can keep a watch on the package and see immediately when it's fixed here.
It's like deja vu all over again.
The yesterday release of M1.7.2 and FF0.9.3 are fixed. Source: http://www.heise.de/security/news/meldung/49786 :)
(German site)
The safer languages would be e.g. python or java. You want an interpreter to decode your images ?
// i - array of ints, length - lenght of array
Anyway shit happens.
An error ?:
int main()
{
char str[] = "Hello";
char *tst = malloc(strlen(str));
strncpy(tst,str,strlen(str));
}
An error ?:
void doFoo(int i* , int length)
{
int j;
for(j = 0 ; j length; j++){
dosomething(i[j]);
}
}
Depending on context both can be fatal.
... with this, and Linux gets to join the "visit a malicious website and get rooted" crowd.
Tarsnap: Online backups for the truly paranoid
Its reassuring that for once MS has already taken care of some security issue (for XP SP2 at least).
Sorry I am kinda new to png stuff... can anyone explain how this might effect my Windows XP box? Should I go get the patch for my system? btw I am running Windows XP professional with service pack 1. Thanks in advance.
! - in case this is for real.
PNG is an image format. It's very popular. There's a free (not copyleft free) library that anyone can put in their software to handle the PNG format.
There's a problem with this free library. If you're using software with a broken version of this library, you'll need to update the software.
The XPSP2RC has either fixed or sidestepped the issue. If you want that, you can get it from Windows Update (v5). But it's still a release candidate so you might prefer to wait.
It isn't. It just means code that is not part of the program itself, but
rather code that is injected into the program/software, and the software
is then tricked to running that code.
I wrote a GIF library in JAVA to display animated gifs on java 1.0 and it was reeeeeeeaaaaaally sloooooooow. It would however not be possible to exploit a buffer overflow on such a decompressor...
Buffer owerflow attacks won't happen in languages which doesn't "support" that feature, such as perl, python, ruby, java, C# (any managed code), or managed C++ for that matter.
:)
Another way of killing the problem is using the NX (I hope I got that correct) instruction/bit in newer CPUs and simply separate code and data, and not allow execution in a data segment. Win SP2 does this, I am sure Linux does/will soon, one of the BSDs have done stuff like this for a while, etc.
So yes, you would prevent it. But then again, calling a javalib from C...
I just patched my SuSE box. Man that was fast ... or perhaps .. it is because Germany is 6 hours ahead of me.
Another way of killing the problem is using the NX (I hope I got that correct) instruction/bit in newer CPUs and simply separate code and data, and not allow execution in a data segment. Win SP2 does this, I am sure Linux does/will soon
Yep, Fedora Core 2 has done this since one of the early kernel revisions (I think it was when they went from 2.6.5 to 2.6.6)
http://blog.nexusuk.org
" Buffer owerflow attacks won't happen ... using the NX"
No, you can still overflow the buffer, thus being able to modify the return pointer, and some variables. What does this mean? If you were lucky/elite, you could get it to jump to a different function. Sure it's not executing your own instructions from the stack, but it's still control.
thanks,
jacob
This explains how it's done:/ ANNOUNC E-exec-shield
http://people.redhat.com/mingo/exec-shield
Microsoft internet explorer has encountered a problem ands needs to close. we are sorry for the inconvience.
...
bla bba
[x] restart mirosoft internet explorer
[b]WOW[/b], it is a portable bug!
can anybody tell us if this is exploitable?
Umm... the point-and-drool update utility in my SuSE box automatically installed the patch last night. No programming or advanced sysadmining was required on my part.
You can protect against this to. The technique is put a ``canary'' on the stack frame and make sure it is still there before you return.
There are at least two patches to gcc that do this. One is called ProPolice. The name of the second is escaping me right now. OpenBSD includes ProPolice by default.
Google on stack-smashing protectors for more info.
(S(SKK)(SKK))(S(SKK)(SKK))