Libpng Library ICC Profile Chunk Off-By-One Denial of Service Vulnerability

Bugtraq ID:	25957
Class:	Design Error
CVE:	CVE-2007-5267 CVE-2007-5266
Remote:	Yes
Local:	No
Published:	Oct 08 2007 12:00AM
Updated:	Jun 12 2009 05:49PM
Credit:	bnanson is credited with the discovery of this vulnerability.
Vulnerable:	VMWare Workstation 6.0.2 VMWare Workstation 6.0.1 VMWare Workstation 6.0 VMWare Server 1.0.4 VMWare Server 1.0.3 VMWare Server 1.0.2 Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 10.0_x86 Sun Solaris 10.0 Sun OpenSolaris build snv_99 Sun OpenSolaris build snv_96 Sun OpenSolaris build snv_95 Sun OpenSolaris build snv_94 Sun OpenSolaris build snv_93 Sun OpenSolaris build snv_92 Sun OpenSolaris build snv_91 Sun OpenSolaris build snv_90 Sun OpenSolaris build snv_89 Sun OpenSolaris build snv_88 Sun OpenSolaris build snv_87 Sun OpenSolaris build snv_86 Sun OpenSolaris build snv_85 Sun OpenSolaris build snv_84 Sun OpenSolaris build snv_83 Sun OpenSolaris build snv_82 Sun OpenSolaris build snv_81 Sun OpenSolaris build snv_80 Sun OpenSolaris build snv_78 Sun OpenSolaris build snv_77 Sun OpenSolaris build snv_76 Sun OpenSolaris build snv_68 Sun OpenSolaris build snv_67 Sun OpenSolaris build snv_64 Sun OpenSolaris build snv_61 Sun OpenSolaris build snv_59 Sun OpenSolaris build snv_57 Sun OpenSolaris build snv_50 Sun OpenSolaris build snv_47 Sun OpenSolaris build snv_45 Sun OpenSolaris build snv_39 Sun OpenSolaris build snv_36 Sun OpenSolaris build snv_29 Sun OpenSolaris build snv_22 Sun OpenSolaris build snv_19 Sun OpenSolaris build snv_13 Sun OpenSolaris build snv_112 Sun OpenSolaris build snv_111a Sun OpenSolaris build snv_111 Sun OpenSolaris build snv_110 Sun OpenSolaris build snv_109 Sun OpenSolaris build snv_108 Sun OpenSolaris build snv_107 Sun OpenSolaris build snv_106 Sun OpenSolaris build snv_105 Sun OpenSolaris build snv_104 Sun OpenSolaris build snv_104 Sun OpenSolaris build snv_103 Sun OpenSolaris build snv_102 Sun OpenSolaris build snv_101a Sun OpenSolaris build snv_101 Sun OpenSolaris build snv_100 Sun OpenSolaris build snv_02 Sun OpenSolaris build snv_01 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 9.0 Slackware Linux 8.1 Slackware Linux 12.0 Slackware Linux 11.0 rPath rPath Linux 1 Redhat Fedora 7 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 libpng libpng3 1.2.13 libpng libpng3 1.2.12 + Slackware Linux 11.0 libpng libpng3 1.2.8 + Slackware Linux 10.2 + Slackware Linux 10.1 + Slackware Linux 10.1 + Trustix Secure Linux 3.0.5 + Trustix Secure Linux 3.0 + Trustix Secure Linux 2.2 libpng libpng3 1.2.5 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.4 _rc1 + Gentoo Linux 1.2 + Gentoo Linux 1.2 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 AMD64 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 10.0 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 amd64 + Mandriva Linux Mandrake 9.2 + Mandriva Linux Mandrake 9.2 + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 ppc + Mandriva Linux Mandrake 9.1 + Mandriva Linux Mandrake 9.1 + Redhat Fedora Core1 + Slackware Linux 10.0 + Slackware Linux 9.1 + Slackware Linux 9.1 + Slackware Linux 9.0 + Slackware Linux 9.0 + Slackware Linux -current + Slackware Linux -current + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 + Ubuntu Ubuntu Linux 4.1 ia32 libpng libpng 1.2.21 Google Android Software Development Kit (SDK) m3-rc37a Foresight Linux Foresight Linux 1.1 Avaya Interactive Response 4.0 Avaya Interactive Response 3.0 Avaya CMS Server 15.0 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.4.11 Apple Mac OS X 10.5
Not Vulnerable:	VMWare Workstation 6.0.3 VMWare Server 1.0.5 libpng libpng 1.2.22 rc1 Google Android Software Development Kit (SDK) m5-rc15

Libpng Library ICC Profile Chunk Off-By-One Denial of Service Vulnerability

The 'libpng' library is prone to a remote denial-of-service vulnerability because the library fails to handle malicious PNG files.

Successful exploits may allow remote attackers to cause denial-of-service conditions on computers running the affected library.

This issue affects 'libpng' 1.2.21 and prior versions.

Libpng Library ICC Profile Chunk Off-By-One Denial of Service Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim into opening a malicious PNG file.

Libpng Library ICC Profile Chunk Off-By-One Denial of Service Vulnerability

Solution:
The vendor has released updates to address this issue. Please see the referenced advisories for more information.


Apple Mac OS X Server 10.5

• Apple Security Update 2008-003 Server (PPC)
  http://www.apple.com/support/downloads/securityupdate2008003serverppc. html


• Apple Security Update 2008-003 Server (Universal)
  http://www.apple.com/support/downloads/securityupdate2008003serveruniv ersal.html

libpng libpng 1.2.21

• libpng libpng-1.2.22rc1.tar.gz
  http://downloads.sourceforge.net/libpng/libpng-1.2.22rc1.tar.gz

Apple Mac OS X 10.4.11

• Apple Security Update 2008-003 (Intel)
  http://www.apple.com/support/downloads/securityupdate2008003intel.html


• Apple Security Update 2008-003 (PPC)
  http://www.apple.com/support/downloads/securityupdate2008003ppc.html

Apple Mac OS X Server 10.4.11

• Apple Security Update 2008-003 Server (PPC)
  http://www.apple.com/support/downloads/securityupdate2008003serverppc. html


• Apple Security Update 2008-003 Server (Universal)
  http://www.apple.com/support/downloads/securityupdate2008003serveruniv ersal.html

Apple Mac OS X 10.5.1

• Apple Security Update 2008-003 (Intel)
  http://www.apple.com/support/downloads/securityupdate2008003intel.html


• Apple Security Update 2008-003 (PPC)
  http://www.apple.com/support/downloads/securityupdate2008003ppc.html

Apple Mac OS X Server 10.5.1

• Apple Security Update 2008-003 Server (PPC)
  http://www.apple.com/support/downloads/securityupdate2008003serverppc. html


• Apple Security Update 2008-003 Server (Universal)
  http://www.apple.com/support/downloads/securityupdate2008003serveruniv ersal.html

Apple Mac OS X 10.5.2

• Apple SecUpd2008-002.dmg
  http://wsidecar.apple.com/cgi-bin/nph-reg3rdpty2.pl/product=18157&cat= 57&platform=osx&method=sa/SecUpd2008-002.dmg


• Apple Security Update 2008-003 (Intel)
  http://www.apple.com/support/downloads/securityupdate2008003intel.html


• Apple Security Update 2008-003 (PPC)
  http://www.apple.com/support/downloads/securityupdate2008003ppc.html

Libpng Library ICC Profile Chunk Off-By-One Denial of Service Vulnerability

References:

• libpng Homepage (libpng)
  
• VMware Server Release Notes (VMware)
  
• VMware Workstation 6.0 Release Notes (VMware)
  
• ASA-2009-208 Security Vulnerability in Solaris libpng(3) (Avaya)
  
• Solution 259989: Security Vulnerability in Solaris libpng(3) May Allow Denial of (Sun)