Tcl/Tk Tk Toolkit TKIMGGIF.C Buffer Overflow Vulnerability
BID:26056
Info
Tcl/Tk Tk Toolkit TKIMGGIF.C Buffer Overflow Vulnerability
| Bugtraq ID: | 26056 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2007-5378 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 12 2007 12:00AM |
| Updated: | Mar 17 2009 04:56PM |
| Credit: | Schelte Bron reported this vulnerability. |
| Vulnerable: |
VMWare ESX Server 3.0.2 VMWare ESX Server 3.0.1 VMWare ESX Server 3.0 VMWare ESX Server 2.5.5 patch 6 VMWare ESX Server 2.5.5 patch 4 VMWare ESX Server 2.5.5 patch 2 VMWare ESX Server 2.5.5 VMWare ESX Server 2.5.4 Patch 5 VMWare ESX Server 2.5.4 Patch 3 VMWare ESX Server 2.5.4 Patch 17 VMWare ESX Server 2.5.4 Patch 16 VMWare ESX Server 2.5.4 patch 15 VMWare ESX Server 2.5.4 patch 13 VMWare ESX Server 2.5.4 Patch 10 VMWare ESX Server 2.5.4 Patch 1 VMWare ESX Server 2.5.4 VMWare ESX Server 3.5 TCL/TK TCL/TK 8.4.12 TCL/TK TCL/TK 8.4.11 TCL/TK TCL/TK 8.4.10 TCL/TK TCL/TK 8.4.9 TCL/TK TCL/TK 8.4.8 TCL/TK TCL/TK 8.4.7 TCL/TK TCL/TK 8.4.6 TCL/TK TCL/TK 8.4.5 TCL/TK TCL/TK 8.4.4 TCL/TK TCL/TK 8.4.3 TCL/TK TCL/TK 8.4.3 TCL/TK TCL/TK 8.4.2 TCL/TK TCL/TK 8.4.1 TCL/TK TCL/TK 8.4 TCL/TK TCL/TK 8.3.5 TCL/TK TCL/TK 8.3.4 TCL/TK TCL/TK 8.3.3 TCL/TK TCL/TK 8.3.2 TCL/TK TCL/TK 8.3.1 TCL/TK TCL/TK 8.3 TCL/TK TCL/TK 8.0 Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 10_x86 Sun Solaris 10_sparc Sun Solaris 10.0_x86 Sun Solaris 10.0 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux WS 2.1 IA64 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 4.5.z Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux ES 2.1 IA64 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux AS 4.5.z Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux AS 2.1 IA64 Redhat Enterprise Linux AS 2.1 Redhat Desktop 4.0 Redhat Advanced Workstation for the Itanium Processor 2.1 IA64 Redhat Advanced Workstation for the Itanium Processor 2.1 IA64 Redhat Advanced Workstation for the Itanium Processor 2.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Avaya Interactive Response 2.0 |
| Not Vulnerable: |
VMWare ESX Server 2.5.5 patch 8 VMWare ESX Server 2.5.4 patch 19 TCL/TK TCL/TK 8.4.13 |
Discussion
Tcl/Tk Tk Toolkit TKIMGGIF.C Buffer Overflow Vulnerability
Tcl/Tk Tk Toolkit is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data before copying it to an insufficiently sized buffer.
An attacker can exploit this issue to cause denial-of-service conditions. Given the nature of this issue, remote code execution may also be possible but has not been confirmed.
Versions prior to Tcl/Tk 8.4.13 are vulnerable.
Tcl/Tk Tk Toolkit is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data before copying it to an insufficiently sized buffer.
An attacker can exploit this issue to cause denial-of-service conditions. Given the nature of this issue, remote code execution may also be possible but has not been confirmed.
Versions prior to Tcl/Tk 8.4.13 are vulnerable.
Exploit / POC
Tcl/Tk Tk Toolkit TKIMGGIF.C Buffer Overflow Vulnerability
Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Tcl/Tk Tk Toolkit TKIMGGIF.C Buffer Overflow Vulnerability
Solution:
The vendor addressed this issue in Tcl/Tk 8.4.13. Please see the references for more information.
Debian Linux 5.0 ia-64
Debian Linux 5.0 alpha
Debian Linux 5.0 mipsel
Debian Linux 4.0 amd64
Debian Linux 4.0 ia-32
Debian Linux 5.0 armel
Debian Linux 5.0
Debian Linux 4.0 mipsel
Debian Linux 5.0 mips
Debian Linux 4.0 ia-64
Debian Linux 4.0 mips
Debian Linux 5.0 sparc
Debian Linux 4.0 arm
Debian Linux 4.0 powerpc
Debian Linux 5.0 ia-32
Debian Linux 5.0 s/390
TCL/TK TCL/TK 8.0
TCL/TK TCL/TK 8.3
TCL/TK TCL/TK 8.3.1
TCL/TK TCL/TK 8.3.2
TCL/TK TCL/TK 8.3.3
TCL/TK TCL/TK 8.3.4
TCL/TK TCL/TK 8.3.5
TCL/TK TCL/TK 8.4
TCL/TK TCL/TK 8.4.11
TCL/TK TCL/TK 8.4.12
TCL/TK TCL/TK 8.4.2
TCL/TK TCL/TK 8.4.3
TCL/TK TCL/TK 8.4.3
TCL/TK TCL/TK 8.4.4
TCL/TK TCL/TK 8.4.5
TCL/TK TCL/TK 8.4.8
TCL/TK TCL/TK 8.4.9
Solution:
The vendor addressed this issue in Tcl/Tk 8.4.13. Please see the references for more information.
Debian Linux 5.0 ia-64
-
Debian libtk-img-dev_1.3-release-7+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- dev_1.3-release-7+lenny1_ia64.deb -
Debian libtk-img-doc_1.3-release-7+lenny1_all.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- doc_1.3-release-7+lenny1_all.deb -
Debian libtk-img_1.3-release-7+lenny1_ia64.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img_ 1.3-release-7+lenny1_ia64.deb
Debian Linux 5.0 alpha
-
Debian libtk-img-dev_1.3-release-7+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- dev_1.3-release-7+lenny1_alpha.deb -
Debian libtk-img-doc_1.3-release-7+lenny1_all.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- doc_1.3-release-7+lenny1_all.deb -
Debian libtk-img_1.3-release-7+lenny1_alpha.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img_ 1.3-release-7+lenny1_alpha.deb
Debian Linux 5.0 mipsel
-
Debian libtk-img-dev_1.3-release-7+lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- dev_1.3-release-7+lenny1_mipsel.deb -
Debian libtk-img-doc_1.3-release-7+lenny1_all.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- doc_1.3-release-7+lenny1_all.deb -
Debian libtk-img_1.3-release-7+lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img_ 1.3-release-7+lenny1_mipsel.deb
Debian Linux 4.0 amd64
-
Debian libtk-img_1.3-15etch3_amd64.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img_ 1.3-15etch3_amd64.deb
Debian Linux 4.0 ia-32
-
Debian libtk-img_1.3-15etch3_i386.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img_ 1.3-15etch3_i386.deb
Debian Linux 5.0 armel
-
Debian libtk-img-doc_1.3-release-7+lenny1_all.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- doc_1.3-release-7+lenny1_all.deb
Debian Linux 5.0
-
Debian libtk-img-doc_1.3-release-7+lenny1_all.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- doc_1.3-release-7+lenny1_all.deb
Debian Linux 4.0 mipsel
-
Debian libtk-img_1.3-15etch3_mipsel.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img_ 1.3-15etch3_mipsel.deb
Debian Linux 5.0 mips
-
Debian libtk-img-dev_1.3-release-7+lenny1_mips.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- dev_1.3-release-7+lenny1_mips.deb -
Debian libtk-img-doc_1.3-release-7+lenny1_all.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- doc_1.3-release-7+lenny1_all.deb -
Debian libtk-img_1.3-release-7+lenny1_mips.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img_ 1.3-release-7+lenny1_mips.deb
Debian Linux 4.0 ia-64
-
Debian libtk-img_1.3-15etch3_ia64.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img_ 1.3-15etch3_ia64.deb
Debian Linux 4.0 mips
-
Debian libtk-img_1.3-15etch3_mips.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img_ 1.3-15etch3_mips.deb
Debian Linux 5.0 sparc
-
Debian libtk-img-dev_1.3-release-7+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- dev_1.3-release-7+lenny1_sparc.deb -
Debian libtk-img-doc_1.3-release-7+lenny1_all.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- doc_1.3-release-7+lenny1_all.deb -
Debian libtk-img_1.3-release-7+lenny1_sparc.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img_ 1.3-release-7+lenny1_sparc.deb
Debian Linux 4.0 arm
-
Debian libtk-img_1.3-15etch3_arm.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img_ 1.3-15etch3_arm.deb
Debian Linux 4.0 powerpc
-
Debian libtk-img_1.3-15etch3_powerpc.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img_ 1.3-15etch3_powerpc.deb
Debian Linux 5.0 ia-32
-
Debian libtk-img-dev_1.3-release-7+lenny1_i386.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- dev_1.3-release-7+lenny1_i386.deb -
Debian libtk-img-doc_1.3-release-7+lenny1_all.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- doc_1.3-release-7+lenny1_all.deb -
Debian libtk-img_1.3-release-7+lenny1_i386.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img_ 1.3-release-7+lenny1_i386.deb
Debian Linux 5.0 s/390
-
Debian libtk-img-dev_1.3-release-7+lenny1_s390.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- dev_1.3-release-7+lenny1_s390.deb -
Debian libtk-img-doc_1.3-release-7+lenny1_all.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img- doc_1.3-release-7+lenny1_all.deb -
Debian libtk-img_1.3-release-7+lenny1_s390.deb
http://security.debian.org/pool/updates/main/libt/libtk-img/libtk-img_ 1.3-release-7+lenny1_s390.deb
TCL/TK TCL/TK 8.0
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.3
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.3.1
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.3.2
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.3.3
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.3.4
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.3.5
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.4
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.4.11
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.4.12
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.4.2
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.4.3
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.4.3
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.4.4
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.4.5
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.4.8
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
TCL/TK TCL/TK 8.4.9
-
TCL/TK tk8.4.16-src.tar.gz
http://downloads.sourceforge.net/tcl/tk8.4.16-src.tar.gz?modtime=11903 86058&big_mirror=1
References
Tcl/Tk Tk Toolkit TKIMGGIF.C Buffer Overflow Vulnerability
References:
References:
- [ 1458234 ] Segmentation fault when using animated GIFs (Tcl/Tk)
- Tcl/Tk Home Page (Tcl/Tk)
- ASA-2008-215 Security Vulnerabilities in the Tcl GUI Toolkit Library may lead to (Avaya)
- RHSA-2008:0134-3 tcltk security update (Red Hat)
- RHSA-2008:0135-1 tk security update (Red Hat)
- RHSA-2008:0135-2 tk security update (Red Hat)
- Solution 237465 : Security Vulnerabilities in the Tcl GUI Toolkit Library may l (Sun)