Imager 8 Bit BMP Heap Based Buffer Overflow Vulnerability

Bugtraq ID:	23711
Class:	Boundary Condition Error
CVE:	CVE-2007-2459
Remote:	Yes
Local:	No
Published:	Apr 30 2007 12:00AM
Updated:	Feb 20 2008 04:05PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Imager Imager 0.56 Imager Imager 0.55 Imager Imager 0.54 Imager Imager 0.53 Imager Imager 0.52 Imager Imager 0.51 Imager Imager 0.50 Imager Imager 0.49 Imager Imager 0.47 Imager Imager 0.46 Imager Imager 0.45 Imager Imager 0.44 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	Imager Imager 0.57

Imager 8 Bit BMP Heap Based Buffer Overflow Vulnerability

Imager is prone to a heap-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input data before copying it to an insufficiently sized memory buffer.

Successful exploits of this vulnerability allow remote attackers to execute arbitrary machine code in the context of an application using the vulnerable library. Failed attempts will likely result in denial-of-service conditions.

NOTE: The effects of successful attacks depend on how system memory is allocated. The implementation of the 'glibc' memory allocator will likely allow an attacker to trigger only denial-of-service conditions. Other allocators may allow arbitrary code execution.

Versions prior to Imager 0.57 are vulnerable.

Imager 8 Bit BMP Heap Based Buffer Overflow Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to process a malicious BMP file with an application using the library.

Imager 8 Bit BMP Heap Based Buffer Overflow Vulnerability

Solution:
The vendor has released version 0.57 to address this issue. Please see the references for more information.


Imager Imager 0.47

• Imager Imager-0.57.tar.gz
  http://www.cpan.org/modules/by-authors/id/T/TO/TONYC/Imager-0.57.tar.g z

Imager Imager 0.46

• Imager Imager-0.57.tar.gz
  http://www.cpan.org/modules/by-authors/id/T/TO/TONYC/Imager-0.57.tar.g z

Imager Imager 0.56

• Imager Imager-0.57.tar.gz
  http://www.cpan.org/modules/by-authors/id/T/TO/TONYC/Imager-0.57.tar.g z

Imager Imager 0.50

• Imager Imager-0.57.tar.gz
  http://www.cpan.org/modules/by-authors/id/T/TO/TONYC/Imager-0.57.tar.g z

Imager Imager 0.51

• Imager Imager-0.57.tar.gz
  http://www.cpan.org/modules/by-authors/id/T/TO/TONYC/Imager-0.57.tar.g z

Imager Imager 0.55

• Imager Imager-0.57.tar.gz
  http://www.cpan.org/modules/by-authors/id/T/TO/TONYC/Imager-0.57.tar.g z

Imager Imager 0.45

• Imager Imager-0.57.tar.gz
  http://www.cpan.org/modules/by-authors/id/T/TO/TONYC/Imager-0.57.tar.g z

Imager Imager 0.49

• Imager Imager-0.57.tar.gz
  http://www.cpan.org/modules/by-authors/id/T/TO/TONYC/Imager-0.57.tar.g z

Imager Imager 0.54

• Imager Imager-0.57.tar.gz
  http://www.cpan.org/modules/by-authors/id/T/TO/TONYC/Imager-0.57.tar.g z

Imager Imager 0.53

• Imager Imager-0.57.tar.gz
  http://www.cpan.org/modules/by-authors/id/T/TO/TONYC/Imager-0.57.tar.g z

Imager Imager 0.44

• Imager Imager-0.57.tar.gz
  http://www.cpan.org/modules/by-authors/id/T/TO/TONYC/Imager-0.57.tar.g z

Imager Imager 0.52

• Imager Imager-0.57.tar.gz
  http://www.cpan.org/modules/by-authors/id/T/TO/TONYC/Imager-0.57.tar.g z

Imager 8 Bit BMP Heap Based Buffer Overflow Vulnerability

References:

• Vendor Homepage (Imager)
  
• Version 0.57 Release Notes (Imager)