Vulnerability Note VU#477512

libpng png_handle_sPLT() integer overflow

Overview

The Portable Network Graphics library (libpng) contains a flaw that could introduce a remotely exploitable vulnerability.

I. Description

The Portable Network Graphics (PNG ) image format is used as an alternative to other image formats such as the Graphics Interchange Format (GIF). The libpng reference library is available for application developers to support the PNG image format.

A potential integer overflow error exists during a memory allocation within the png_handle_sPLT() function. While the code that contains this error introduces a dangerous condition, it is unclear what practical vulnerabilities it might present in applications using libpng.

Multiple applications support the PNG image format, including web browsers, email clients, and various graphic utilities. Because multiple products have used the libpng reference library to implement native PNG image processing, multiple applications will be affected by this issue in different ways.

II. Impact

The complete impact of this vulnerability is not yet known.

III. Solution

Apply a patch from the vendor

Patches have been released to address this vulnerability. Please see the Systems Affected section of this document for more details.

Systems Affected

Vendor	Status	Date Updated
Apple Computer Inc.	Vulnerable	1-Jun-2005
BSDI	Unknown	23-Jul-2004
Conectiva	Unknown	23-Jul-2004
Cray Inc.	Unknown	23-Jul-2004
Debian	Unknown	23-Jul-2004
eMC Corporation	Unknown	23-Jul-2004
engarde	Unknown	23-Jul-2004
FreeBSD	Unknown	23-Jul-2004
Fujitsu	Unknown	23-Jul-2004
Gentoo	Vulnerable	20-Aug-2004
Hewlett-Packard Company	Unknown	23-Jul-2004
Hitachi	Unknown	23-Jul-2004
IBM	Unknown	23-Jul-2004
IBM-zSeries	Unknown	23-Jul-2004
IBM eServer	Unknown	23-Jul-2004
IMmunix	Unknown	23-Jul-2004
Ingrian Networks	Unknown	23-Jul-2004
Juniper Networks	Not Vulnerable	23-Jul-2004
libpng.org	Vulnerable	4-Aug-2004
MandrakeSoft	Unknown	23-Jul-2004
Microsoft Corporation	Unknown	23-Jul-2004
MontaVista Software	Unknown	23-Jul-2004
NEC Corporation	Not Vulnerable	3-Aug-2004
NETBSD	Unknown	23-Jul-2004
Nokia	Unknown	23-Jul-2004
Novell	Unknown	23-Jul-2004
OpenPKG	Vulnerable	20-Aug-2004
Openwall GNU/*/Linux	Unknown	23-Jul-2004
Red Hat Inc.	Unknown	23-Jul-2004
ScO	Unknown	23-Jul-2004
Sequent	Unknown	23-Jul-2004
SGI	Unknown	23-Jul-2004
Slackware	Vulnerable	20-Aug-2004
Sony Corporation	Unknown	23-Jul-2004
Sun Microsystems Inc.	Unknown	23-Jul-2004
SuSE Inc.	Unknown	23-Jul-2004
Trustix Secure Linux	Vulnerable	20-Aug-2004
TurboLinux	Unknown	23-Jul-2004
uNisys	Unknown	23-Jul-2004
Wind River Systems Inc.	Unknown	23-Jul-2004

References

http://scary.beasts.org/security/CESA-2004-001.txt
http://www.libpng.org/pub/png/
http://libpng.sourceforge.net/

Credit

Thanks to Chris Evans for reporting this vulnerability.

This document was written by Chad Dougherty and Damon Morda.

Other Information

Date Public	08/04/2004
Date First Published	08/04/2004 12:05:23 PM
Date Last Updated	06/01/2005
CERT Advisory
CVE Name	CAN-2004-0599
US-CERT Technical Alerts
Metric	0.76
Document Revision	16

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader