Vulnerability Note VU#576029

libpng stalls on highly compressed ancillary chunks

Overview

Libpng stalls and consumes large quantities of memory while processing certain Portable Network Graphics (PNG) files.

I. Description

When processing PNG files containing highly compressed ancillary chunks, the png_decompress_chunk() function in libpng can consume large amounts of CPU time and memory. This resource consumption may hang applications that use libpng. More information is available in the PNG Development Group security advisory and supplementary document, Defending Libpng Applications Against Decompression Bombs.

II. Impact

This vulnerability could allow an unauthenticated, remote attacker to cause a denial of service.

III. Solution

Upgrade

The PNG Development Group has released versions 1.4.1, 1.2.43, and 1.0.53, which provide more efficient decompression of ancillary chunks. This update decreases resource consumption associated with chunk decompression, but may not provide a complete defense unless coupled with appropriate memory limits.

Set limits on memory usage and number of cached ancillary chunks

Libpng provides functions to limit memory consumption and number of cached ancillary chunks. Applications that use libpng should use these functions to set appropriate limits. Please see defense #2 in the document Defending Libpng Applications Against Decompression Bombs for more information.

Disable Ancillary Chunk Decoding
Developers who build versions of libpng can choose to ignore ancillary chunks by defining specific preprocessor macros. Please see defense #3 in the document Defending Libpng Applications Against Decompression Bombs for more information.

Systems Affected

Vendor	Status	Date Notified	Date Updated
Apple Inc.	Unknown	2010-02-16	2010-02-16
Conectiva Inc.	Unknown	2010-02-16	2010-02-16
Cray Inc.	Unknown	2010-02-16	2010-02-16
Debian GNU/Linux	Unknown	2010-02-16	2010-02-16
DragonFly BSD Project	Unknown	2010-02-16	2010-02-16
EMC Corporation	Unknown	2010-02-16	2010-02-16
Engarde Secure Linux	Unknown	2010-02-16	2010-02-16
F5 Networks, Inc.	Unknown	2010-02-16	2010-02-16
Fedora Project	Unknown	2010-02-16	2010-02-16
FreeBSD Project	Unknown	2010-02-16	2010-02-16
Fujitsu	Unknown	2010-02-16	2010-02-16
Gentoo Linux	Unknown	2010-02-16	2010-02-16
Hewlett-Packard Company	Unknown	2010-02-16	2010-02-16
Hitachi	Unknown	2010-02-16	2010-02-16
IBM Corporation	Unknown	2010-02-16	2010-02-16
IBM Corporation (zseries)	Unknown	2010-02-16	2010-02-16
IBM eServer	Unknown	2010-02-16	2010-02-16
Infoblox	Unknown	2010-02-16	2010-02-16
Internet Initiative Japan, Inc.	Not Vulnerable	2010-02-16	2010-03-02
Juniper Networks, Inc.	Unknown	2010-02-16	2010-02-16
Mandriva S. A.	Unknown	2010-02-16	2010-02-16
Microsoft Corporation	Unknown	2010-02-16	2010-02-16
MontaVista Software, Inc.	Unknown	2010-02-16	2010-02-16
NEC Corporation	Unknown	2010-02-16	2010-02-16
NetBSD	Unknown	2010-02-16	2010-02-16
Nokia	Unknown	2010-02-16	2010-02-16
Novell, Inc.	Unknown	2010-02-16	2010-02-16
OpenBSD	Unknown	2010-02-16	2010-02-16
Openwall GNU/*/Linux	Unknown	2010-02-16	2010-02-16
QNX Software Systems Inc.	Unknown	2010-02-16	2010-02-16
Red Hat, Inc.	Unknown	2010-02-16	2010-02-16
SafeNet	Unknown	2010-02-16	2010-02-16
Silicon Graphics, Inc.	Unknown	2010-02-16	2010-02-16
Slackware Linux Inc.	Unknown	2010-02-16	2010-02-16
Sony Corporation	Unknown	2010-02-16	2010-02-16
Sun Microsystems, Inc.	Unknown	2010-02-16	2010-02-16
SUSE Linux	Unknown	2010-02-16	2010-02-16
The SCO Group	Unknown	2010-02-16	2010-02-16
Turbolinux	Unknown	2010-02-16	2010-02-16
Ubuntu	Unknown	2010-02-16	2010-02-16
Unisys	Unknown	2010-02-16	2010-02-16
Wind River Systems, Inc.	Unknown	2010-02-16	2010-02-16

References

http://libpng.sourceforge.net/ADVISORY-1.4.1.html
http://libpng.sourceforge.net/decompression_bombs.html

Credit

This issue was reported by the PNG Development Group.

This document was written by David Warren.

Other Information

Date Public:	2010-03-01
Date First Published:	2010-03-02
Date Last Updated:	2010-03-02
CERT Advisory:
CVE-ID(s):	CVE-2010-0205
NVD-ID(s):	CVE-2010-0205
US-CERT Technical Alerts:
Metric:	0.85
Document Revision:	16

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2010 by US-CERT, a government organization
Disclaimers and copyright information Get a PDF Reader