Bug 805912 (CVE-2012-1499)

Summary: CVE-2012-1499 openjpeg: Out-of heap-based buffer write by processing palette information in certain JPEG 2000 images
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: adam, erik-fedora, jcapik, oliver, rdieter, tgl
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20120320,reported=20120321,source=gentoo,cvss2=6.8/AV:N/AC:M/Au:N/C:P/I:P/A:P,epel-5/openjpeg=notaffected,rhel-6/openjpeg=notaffected,fedora-all/openjpeg=affected,fedora-all/mingw32-openjpeg=notaffected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-07-05 23:29:38 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 805915    
Bug Blocks: 806228    

Description Jan Lieskovsky 2012-03-22 08:45:53 EDT
An out-of heap-based buffer write flaw was found in the way JP2, the JPEG-2000 file format reader / writer of the OpenJPEG, an open-source JPEG 2000 codec, performed processing of palette information, present in JP2 Header Box for certain JPEG 2000 format images. A remote attacker could provide a JPEG 2000 format image file with specially-crafted value of palette index, which once processed by the JPEG 2000 decoder would leak to JPEG 2000 decoder crash, or, potentially arbitrary code execution with the privileges of the user running the decoder.

References:
[1] http://technet.microsoft.com/en-us/security/msvr/msvr12-004
[2] https://secunia.com/advisories/48498/

Possible upstream patch, but it references MSVR-11-117 id instead of MSVR12-004.  We need to confirm both refer to the same issue:

[3] http://code.google.com/p/openjpeg/source/detail?r=1330
Comment 1 Jan Lieskovsky 2012-03-22 08:53:20 EDT
This issue did NOT affect the version of the openjpeg package, as shipped with Red Hat Enterprise Linux 6.

--

This issue did NOT affect the version of the openjpeg package, as shipped with Fedora EPEL 5.

--

This issue did NOT affect the versions of the mingw32-openjpeg package, as shipped with Fedora release of 15 and 16.

--

This issue affects the versions of the openjpeg package, as shipped with Fedora release of 15 and 16. Please schedule an update.
Comment 2 Jan Lieskovsky 2012-03-22 08:54:27 EDT
Created openjpeg tracking bugs for this issue

Affects: fedora-all [bug 805915]
Comment 3 Jan Lieskovsky 2012-04-11 06:28:55 EDT
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1499 to the following vulnerability:

The JPEG 2000 codec in OpenJPEG before 1.5 does not properly allocate memory during file parsing, which allows remote attackers to execute arbitrary code via a crafted file.

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1499
[2] http://openjpeg.googlecode.com/svn/branches/openjpeg-1.5/NEWS
[3] http://technet.microsoft.com/en-us/security/msvr/msvr12-004
Comment 4 Fedora Update System 2012-06-27 23:21:00 EDT
openjpeg-1.4-13.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2012-06-27 23:53:27 EDT
openjpeg-1.4-13.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Tomas Hoger 2012-07-02 04:09:30 EDT
(In reply to comment #0)
> [3] http://code.google.com/p/openjpeg/source/detail?r=1330

Code corrected by this fix was introduced in the following commit:

http://code.google.com/p/openjpeg/source/detail?spec=svn636&r=636
http://code.google.com/p/openjpeg/source/diff?old=505&r=636&format=unidiff&path=%2Ftrunk%2Flibopenjpeg%2Fjp2.c

It does not exist in the openjpeg version in Red Hat Enterprise Linux 6.
Comment 7 Huzaifa S. Sidhpurwala 2012-07-05 23:29:38 EDT
Statement:

Not Vulnerable. This issue did not affect the version of openjpeg as shipped with Red Hat Enterprise Linux 6.
Comment 8 Tomas Hoger 2012-07-06 05:32:46 EDT
(In reply to comment #0)
> Possible upstream patch, but it references MSVR-11-117 id instead of
> MSVR12-004.  We need to confirm both refer to the same issue:
> 
> [3] http://code.google.com/p/openjpeg/source/detail?r=1330

Microsoft Vulnerability Research (MSVR) confirmed both identifiers are for the same issue.