Bug 473905 (CVE-2008-5286)

Summary:	CVE-2008-5286 cups: Incomplete fix for CVE-2008-1722
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	kreilly, twaugh, ykopkova
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-04-17 10:02:54 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	473909, 474353
Bug Blocks:

Description Jan Lieskovsky 2008-12-01 12:17:25 UTC

Common Vulnerabilities and Exposures originally assigned an identifier CVE-2008-1722 to the following vulnerability:

Multiple integer overflows in (1) filter/image-png.c and (2) filter/image-zoom.c in CUPS 1.3 allow attackers to cause a denial of service (crash) and trigger memory corruption, as demonstrated via a crafted PNG image.

It was discovered, the original patch for this issue was incomplete and
integer overflow in filter/image-png.c was still present. This could allow
an attacker to cause a denial of service (crash) via a crafted PNG image.

References:
http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt
http://www.cups.org/str.php?L2974

Patch:
http://www.cups.org/strfiles/2974/str2974.patch

Comment 2 Jan Lieskovsky 2008-12-01 14:36:28 UTC

Description from the CVE entry:

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17
through 1.3.9 allows remote attackers to execute arbitrary code via a
PNG image with a large height value, which bypasses a validation check
and triggers a buffer overflow.

Comment 3 Tomas Hoger 2008-12-03 08:24:46 UTC

This issue does not affect systems where CUPS uses libpng version 1.2.6rc1 (released in Aug 2004) or later, as libpng itself imposes limits on maximum width and height of the image (quoting libpng's CHANGES file):

  Imposed default one million column, one-million row limits on the image 
    dimensions, and added png_set_user_limits() function to override them.

Due to this check, images with size that could cause integer overflow in the bufsize check are rejected earlier in the image processing.

Therefore, this issue did not affect CUPS versions as shipped in Red Hat Enterprise Linux 4 and 5 and current Fedora versions, as they all use version of libpng newer than 1.2.6rc1.

libpng limits in the version shipped in Red Hat Enterprise Linux 3 are much higher and do not prevent this possible overflow.

Comment 9 Tomas Hoger 2009-04-17 09:59:55 UTC

This flaw was addressed upstream in 1.3.10:
  http://www.cups.org/articles.php?L582

Comment 10 Red Hat Product Security 2009-04-17 10:02:54 UTC

This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2008-1028.html