XV Multiple Buffer Overflow and Integer Handling Vulnerabilities
BID:10985
Info
XV Multiple Buffer Overflow and Integer Handling Vulnerabilities
| Bugtraq ID: | 10985 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2004-1725 CVE-2004-1726 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 20 2004 12:00AM |
| Updated: | Jul 12 2009 06:17AM |
| Credit: | Discovery of these vulnerabilities is credited to Sean <[email protected]> |
| Vulnerable: |
John Bradley XV 3.10 a |
| Not Vulnerable: | |
Discussion
XV Multiple Buffer Overflow and Integer Handling Vulnerabilities
xv is an image manipulation utility for the X Window System.
xv is reported prone to multiple buffer overflow and integer overflow vulnerabilities. The following issues are reported:
A stack based buffer overflow exists in the 'xvbmp.c' source file. It is reported that a user-supplied value is employed to iterate a loop that copies data into a finite stack based buffer.
Multiple heap overflow vulnerabilities are reported to exist in the 'xviris.c' source file. The vulnerabilities are reported to exist due to integer handling problems. It is reported that an attacker may supply an integer value that is employed as a value during heap based memory allocation; this value may cause the allocation of an insufficient chunk of memory.
A heap overflow vulnerability is reported to exist in the 'xvpcx.c' source file. The vulnerability is reported to exist due to integer handling problems. It is reported that an attacker may supply an integer value that is employed as a value during heap based memory allocation; this value may cause the allocation of an insufficient chunk of memory.
An additional heap overflow vulnerability is reported to exist in the 'xvpm.c' source file. The vulnerability is again reported to exist due to integer handling problems. It is reported that an attacker may supply an integer value that is employed as a value during heap based memory allocation; this value may cause the allocation of an insufficient chunk of memory.
xv is an image manipulation utility for the X Window System.
xv is reported prone to multiple buffer overflow and integer overflow vulnerabilities. The following issues are reported:
A stack based buffer overflow exists in the 'xvbmp.c' source file. It is reported that a user-supplied value is employed to iterate a loop that copies data into a finite stack based buffer.
Multiple heap overflow vulnerabilities are reported to exist in the 'xviris.c' source file. The vulnerabilities are reported to exist due to integer handling problems. It is reported that an attacker may supply an integer value that is employed as a value during heap based memory allocation; this value may cause the allocation of an insufficient chunk of memory.
A heap overflow vulnerability is reported to exist in the 'xvpcx.c' source file. The vulnerability is reported to exist due to integer handling problems. It is reported that an attacker may supply an integer value that is employed as a value during heap based memory allocation; this value may cause the allocation of an insufficient chunk of memory.
An additional heap overflow vulnerability is reported to exist in the 'xvpm.c' source file. The vulnerability is again reported to exist due to integer handling problems. It is reported that an attacker may supply an integer value that is employed as a value during heap based memory allocation; this value may cause the allocation of an insufficient chunk of memory.
Exploit / POC
XV Multiple Buffer Overflow and Integer Handling Vulnerabilities
The following exploit is available:
The following exploit is available:
Solution / Fix
XV Multiple Buffer Overflow and Integer Handling Vulnerabilities
Solution:
Gentoo has released an advisory and fixes to address this issue. Fixes may be applied by the superuser with the following commands:
emerge sync
emerge -pv ">=media-gfx/xv-3.10a-r7"
emerge ">=media-gfx/xv-3.10a-r7"
Slackware Linux has released advisory SSA:2005-195-02, along with fixes to address various issues. Please see the referenced advisory for further information.
John Bradley XV 3.10 a
Solution:
Gentoo has released an advisory and fixes to address this issue. Fixes may be applied by the superuser with the following commands:
emerge sync
emerge -pv ">=media-gfx/xv-3.10a-r7"
emerge ">=media-gfx/xv-3.10a-r7"
Slackware Linux has released advisory SSA:2005-195-02, along with fixes to address various issues. Please see the referenced advisory for further information.
John Bradley XV 3.10 a
-
Slackware xv-3.10a-i386-4.tgz
Slackware 8.1
ftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/x v-3.10a-i386-4.tgz -
Slackware xv-3.10a-i386-4.tgz
Slackware 9.0
ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/x v-3.10a-i386-4.tgz -
Slackware xv-3.10a-i486-4.tgz
Slackware 10.0
ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ xv-3.10a-i486-4.tgz -
Slackware xv-3.10a-i486-4.tgz
Slackware 10.1
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/ xv-3.10a-i486-4.tgz -
Slackware xv-3.10a-i486-4.tgz
Slackware 9.1
ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/x v-3.10a-i486-4.tgz -
Slackware xv-3.10a-i486-4.tgz
Slackware -current
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/ xv-3.10a-i486-4.tgz
References
XV Multiple Buffer Overflow and Integer Handling Vulnerabilities
References:
References:
- XV Homepage (John Bradley)
- XV multiple buffer overflows (update) (Greg Roelofs
- XV multiple buffer overflows, exploit included ([email protected])