Bug 473905 - (CVE-2008-5286) CVE-2008-5286 cups: Incomplete fix for CVE-2008-1722
CVE-2008-5286 cups: Incomplete fix for CVE-2008-1722
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
reported=20081121,public=20081016,sou...
: Security
Depends On: 473909 474353
Blocks:
  Show dependency treegraph
 
Reported: 2008-12-01 07:17 EST by Jan Lieskovsky
Modified: 2009-04-17 06:02 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-04-17 06:02:54 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jan Lieskovsky 2008-12-01 07:17:25 EST
Common Vulnerabilities and Exposures originally assigned an identifier CVE-2008-1722 to the following vulnerability:

Multiple integer overflows in (1) filter/image-png.c and (2) filter/image-zoom.c in CUPS 1.3 allow attackers to cause a denial of service (crash) and trigger memory corruption, as demonstrated via a crafted PNG image.

It was discovered, the original patch for this issue was incomplete and
integer overflow in filter/image-png.c was still present. This could allow
an attacker to cause a denial of service (crash) via a crafted PNG image.

References:
http://svn.easysw.com/public/cups/trunk/CHANGES-1.3.txt
http://www.cups.org/str.php?L2974

Patch:
http://www.cups.org/strfiles/2974/str2974.patch
Comment 2 Jan Lieskovsky 2008-12-01 09:36:28 EST
Description from the CVE entry:

Integer overflow in the _cupsImageReadPNG function in CUPS 1.1.17
through 1.3.9 allows remote attackers to execute arbitrary code via a
PNG image with a large height value, which bypasses a validation check
and triggers a buffer overflow.
Comment 3 Tomas Hoger 2008-12-03 03:24:46 EST
This issue does not affect systems where CUPS uses libpng version 1.2.6rc1 (released in Aug 2004) or later, as libpng itself imposes limits on maximum width and height of the image (quoting libpng's CHANGES file):

  Imposed default one million column, one-million row limits on the image 
    dimensions, and added png_set_user_limits() function to override them.

Due to this check, images with size that could cause integer overflow in the bufsize check are rejected earlier in the image processing.

Therefore, this issue did not affect CUPS versions as shipped in Red Hat Enterprise Linux 4 and 5 and current Fedora versions, as they all use version of libpng newer than 1.2.6rc1.

libpng limits in the version shipped in Red Hat Enterprise Linux 3 are much higher and do not prevent this possible overflow.
Comment 9 Tomas Hoger 2009-04-17 05:59:55 EDT
This flaw was addressed upstream in 1.3.10:
  http://www.cups.org/articles.php?L582
Comment 10 Red Hat Product Security 2009-04-17 06:02:54 EDT
This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2008-1028.html

Note You need to log in before you can comment on or make changes to this bug.