Vulnerability Note VU#537878

libXpm library contains multiple integer overflow vulnerabilities

Overview

libXpm contains multiple integer overflow vulnerabilities that may allow an attacker to cause a denial-of-service condition or execute arbitrary code.

I. Description

XPM is a format for encoding and decoding X PixMap images that is used in the X Windows System 11 (X11). libXpm is a library of functions used to manipulate XPM images. Multiple libXpmroutines contain integer overflow vulnerabilities including, but not necessarily limited to, the following functions:

xpmParseColors
XpmCreateImageFromXpmImage
CreateXImage
ParsePixels
ParseAndPutPixels
ParsePixels

These issues are the result of insufficient validation of user-supplied data. Consequently, an attacker may be able to exploit these vulnerabilities by supplying an application using libXpm with a specially crafted XPM image. Applications that receive input from remote sources may be remotely exploitable.

Any program that uses the libXpm library may be affected by this issue. Users are encouraged to contact their vendors to determine if they are vulnerable.

II. Impact

Specific impacts depend on the application and libXpm routine being attacked. Potential consequences range from abrupt and abnormal program termination to the execution of arbitrary code with the privileges of the compromised program.

III. Solution

Apply a Patch for X11 Version 6.8.0

The X.org Foundation has released a patch to address this issue in version 6.8.0. In addition, several vendors of relevant or derived implementations have released patches to address this vulnerability; please contact those vendors for further details.

Upgrade X11

This issue has been fixed in X11 version 6.8.1.

Systems Affected

Vendor	Status	Date Notified
Apple Computer Inc.	Unknown	11-Oct-2004
BSDI	Unknown	11-Oct-2004
Connectiva	Unknown	11-Oct-2004
Cray Inc.	Unknown	11-Oct-2004
Debian	Vulnerable	11-Oct-2004
EMC Corporation	Unknown	11-Oct-2004
Engarde	Unknown	11-Oct-2004
F5 Networks	Unknown	11-Oct-2004
FreeBSD	Vulnerable	11-Oct-2004
Fujitsu	Unknown	11-Oct-2004
Gentoo	Unknown	11-Oct-2004
Hewlett-Packard Company	Vulnerable	6-Oct-2005
Hitachi	Unknown	11-Oct-2004
IBM	Unknown	11-Oct-2004
IBM-zSeries	Unknown	11-Oct-2004
IBM eServer	Unknown	11-Oct-2004
Immunix	Unknown	11-Oct-2004
Ingrian Networks	Unknown	11-Oct-2004
Juniper Networks	Unknown	11-Oct-2004
MandrakeSoft	Unknown	11-Oct-2004
MontaVista Software	Unknown	11-Oct-2004
NEC Corporation	Unknown	11-Oct-2004
NETBSD	Unknown	11-Oct-2004
Nokia	Unknown	11-Oct-2004
Novell	Unknown	11-Oct-2004
OpenBSD	Unknown	27-Sep-2004
Openwall GNU/*/Linux	Unknown	11-Oct-2004
Red Hat Inc.	Unknown	11-Oct-2004
SCO	Unknown	11-Oct-2004
Sequent	Unknown	11-Oct-2004
SGI	Unknown	11-Oct-2004
Sony Corporation	Unknown	11-Oct-2004
Sun Microsystems Inc.	Unknown	11-Oct-2004
SuSE Inc.	Vulnerable	11-Oct-2004
TurboLinux	Unknown	11-Oct-2004
Unisys	Unknown	11-Oct-2004
Wind River Systems Inc.	Unknown	11-Oct-2004
X Consortium	Unknown	20-Sep-2004
X11	Unknown	30-Sep-2004

References

http://scary.beasts.org/security/CESA-2004-003.txt
http://secunia.com/advisories/12549/
http://www.securitytracker.com/alerts/2004/Sep/1011324.html
http://www.x.org/pub/X11R6.8.0/patches/README.xorg-CAN-2004-0687-0688.patch

Credit

This vulnerability was publicly reported by Chris Evans.

This document was written by Jeffrey Gennari.

Other Information

Date Public:	2004-09-16
Date First Published:	2004-09-30
Date Last Updated:	2005-10-06
CERT Advisory:
CVE-ID(s):	CAN-2004-0688
NVD-ID(s):	CAN-2004-0688
US-CERT Technical Alerts:
Metric:	2.82
Document Revision:	225

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader