Vulnerability Note VU#160448

libpng integer overflow in image height processing

Overview

The Portable Network Graphics library (libpng) contains a remotely exploitable vulnerability which could cause affected applications to crash.

I. Description

The Portable Network Graphics (PNG ) image format is used as an alternative to other image formats such as the Graphics Interchange Format (GIF). The libpng reference library is available for application developers to support the PNG image format.

An integer overflow error exists in the handling of PNG image height within the png_read_png() function. As a result, a PNG image with excessive height may cause an integer overflow on a memory allocation and could cause the affected application to crash.

Multiple applications support the PNG image format including web browsers, email clients, and various graphic utilities. Because multiple products have used the libpng reference library to implement native PNG image processing, multiple applications will be affected by this issue in different ways.

II. Impact

An attacker could cause a vulnerable application to crash by supplying a specially-crafted PNG image. Vulnerable applications that read images from network sources could be exploited remotely.

III. Solution

Apply a patch from the vendor

Patches have been released to address this vulnerability. Please see the Systems Affected section of this document for more details.

Systems Affected

Vendor	Status	Date Notified
Apple Computer Inc.	Vulnerable	4-Aug-2004
BSDI	Unknown	23-Jul-2004
Conectiva	Unknown	23-Jul-2004
Cray Inc.	Unknown	23-Jul-2004
Debian	Unknown	23-Jul-2004
eMC Corporation	Unknown	23-Jul-2004
Engarde	Unknown	23-Jul-2004
FreeBSD	Unknown	23-Jul-2004
Fujitsu	Unknown	23-Jul-2004
Hewlett-Packard Company	Unknown	23-Jul-2004
Hitachi	Unknown	23-Jul-2004
IBM	Not Vulnerable	4-Aug-2004
IBM-zSeries	Unknown	23-Jul-2004
IBM eServer	Unknown	23-Jul-2004
IMmunix	Unknown	23-Jul-2004
Ingrian Networks	Unknown	23-Jul-2004
Juniper Networks	Not Vulnerable	23-Jul-2004
libpng.org	Vulnerable	4-Aug-2004
MandrakeSoft	Unknown	23-Jul-2004
Microsoft Corporation	Unknown	23-Jul-2004
MontaVista Software	Vulnerable	4-Aug-2004
NEC Corporation	Not Vulnerable	3-Aug-2004
NETBSD	Unknown	23-Jul-2004
Nokia	Unknown	23-Jul-2004
Novell	Unknown	23-Jul-2004
Openwall GNU/*/Linux	Unknown	23-Jul-2004
Red Hat Inc.	Unknown	23-Jul-2004
SCO	Unknown	23-Jul-2004
Sequent	Unknown	23-Jul-2004
SGI	Unknown	23-Jul-2004
Sony Corporation	Unknown	23-Jul-2004
Sun Microsystems Inc.	Unknown	23-Jul-2004
SuSE Inc.	Unknown	23-Jul-2004
TurboLinux	Unknown	23-Jul-2004
Unisys	Unknown	23-Jul-2004
Wind River Systems Inc.	Unknown	23-Jul-2004

References

http://scary.beasts.org/security/CESA-2004-001.txt
http://www.libpng.org/pub/png/
http://libpng.sourceforge.net/

Credit

Thanks to Chris Evans for reporting this vulnerability.

This document was written by Chad Dougherty and Damon Morda.

Other Information

Date Public:	2004-08-04
Date First Published:	2004-08-04
Date Last Updated:	2004-08-04
CERT Advisory:
CVE-ID(s):	CAN-2004-0599
NVD-ID(s):	CAN-2004-0599
US-CERT Technical Alerts:
Metric:	0.97
Document Revision:	9

If you have feedback, comments, or additional information about this vulnerability, please send us email.