Graphviz Graph Parser Remote Stack Buffer Overflow Vulnerability

Bugtraq ID:	31648
Class:	Boundary Condition Error
CVE:	CVE-2008-4555
Remote:	Yes
Local:	No
Published:	Oct 08 2008 12:00AM
Updated:	Mar 19 2015 09:31AM
Credit:	Roee Hay
Vulnerable:	SuSE SUSE Linux Enterprise SDK 10.SP1 SuSE SUSE Linux Enterprise SDK 10 SP2 SuSE SUSE Linux Enterprise Desktop 10 SP2 SuSE SUSE Linux Enterprise Desktop 10 SP1 SuSE openSUSE 10.3 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.2 Pardus Linux 2008 0 Pardus Linux 2007 0 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Graphviz Graphviz 2.20.2 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 + Mandriva Linux Mandrake 2006.0 x86_64 + Mandriva Linux Mandrake 2006.0 Gentoo Linux
Not Vulnerable:	Graphviz Graphviz 2.20.3 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 + Mandriva Linux Mandrake 2006.0 x86_64 + Mandriva Linux Mandrake 2006.0

Graphviz Graph Parser Remote Stack Buffer Overflow Vulnerability

Graphviz is prone to a remote stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers can leverage this issue to execute arbitrary code in the context of the application. Successful exploits will compromise the application and possibly the underlying computer. Failed attacks will cause denial-of-service conditions.

Graphviz 2.20.2 is vulnerable; other versions may also be affected.

Graphviz Graph Parser Remote Stack Buffer Overflow Vulnerability

The original reporter has developed an exploit. This exploit is not otherwise publicly available or known to be circulating in the wild.

Graphviz Graph Parser Remote Stack Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Mandriva Linux Mandrake 2008.1 x86_64

• Mandriva graphviz-2.16.1-3.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva graphviz-doc-2.16.1-3.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviz-devel-2.16.1-3.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviz-static-devel-2.16.1-3.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviz4-2.16.1-3.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizlua0-2.16.1-3.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizocaml0-2.16.1-3.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizperl0-2.16.1-3.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizphp0-2.16.1-3.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizpython0-2.16.1-3.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizr0-2.16.1-3.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizruby0-2.16.1-3.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviztcl0-2.16.1-3.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.1

• Mandriva graphviz-2.16.1-3.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva graphviz-doc-2.16.1-3.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviz-devel-2.16.1-3.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviz-static-devel-2.16.1-3.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviz4-2.16.1-3.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizlua0-2.16.1-3.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizocaml0-2.16.1-3.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizperl0-2.16.1-3.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizphp0-2.16.1-3.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizpython0-2.16.1-3.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizr0-2.16.1-3.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizruby0-2.16.1-3.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviztcl0-2.16.1-3.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0

• Mandriva graphviz-2.20.2-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva graphviz-doc-2.20.2-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviz-devel-2.20.2-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviz-static-devel-2.20.2-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviz4-2.20.2-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizlua0-2.20.2-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizocaml0-2.20.2-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizperl0-2.20.2-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizphp0-2.20.2-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizpython0-2.20.2-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizr0-2.20.2-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizruby0-2.20.2-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviztcl0-2.20.2-3.1mdv2009.0.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva graphviz-2.20.2-3.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva graphviz-doc-2.20.2-3.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviz-devel-2.20.2-3.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviz-static-devel-2.20.2-3.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviz4-2.20.2-3.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizlua0-2.20.2-3.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizocaml0-2.20.2-3.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizperl0-2.20.2-3.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizphp0-2.20.2-3.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizpython0-2.20.2-3.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizr0-2.20.2-3.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizruby0-2.20.2-3.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviztcl0-2.20.2-3.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 4.0

• Mandriva graphviz-2.2.1-3.2.20060mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviz7-2.2.1-3.2.20060mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviz7-devel-2.2.1-3.2.20060mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviztcl7-2.2.1-3.2.20060mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviztcl7-devel-2.2.1-3.2.20060mdk.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva graphviz-2.20.2-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva graphviz-doc-2.20.2-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviz-devel-2.20.2-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviz-static-devel-2.20.2-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviz4-2.20.2-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizlua0-2.20.2-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizocaml0-2.20.2-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizperl0-2.20.2-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizphp0-2.20.2-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizpython0-2.20.2-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizr0-2.20.2-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizruby0-2.20.2-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviztcl0-2.20.2-3.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva graphviz-2.12-6.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva graphviz-doc-2.12-6.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviz-devel-2.12-6.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviz-static-devel-2.12-6.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviz3-2.12-6.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizlua0-2.12-6.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizperl0-2.12-6.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizphp0-2.12-6.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizpython0-2.12-6.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphvizruby0-2.12-6.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviztcl0-2.12-6.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5

• Mandriva graphviz-2.20.2-3.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva graphviz-doc-2.20.2-3.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviz-devel-2.20.2-3.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviz-static-devel-2.20.2-3.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviz4-2.20.2-3.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizlua0-2.20.2-3.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizocaml0-2.20.2-3.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizperl0-2.20.2-3.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizphp0-2.20.2-3.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizpython0-2.20.2-3.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizr0-2.20.2-3.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizruby0-2.20.2-3.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviztcl0-2.20.2-3.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.0

• Mandriva graphviz-2.12-6.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva graphviz-doc-2.12-6.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviz-devel-2.12-6.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviz-static-devel-2.12-6.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviz3-2.12-6.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizlua0-2.12-6.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizperl0-2.12-6.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizphp0-2.12-6.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizpython0-2.12-6.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphvizruby0-2.12-6.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libgraphviztcl0-2.12-6.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Graphviz Graphviz 2.20.2

• Graphviz graphviz-2.20.3.tar.gz
  http://www.graphviz.org/pub/graphviz/stable/SOURCES/graphviz-2.20.3.ta r.gz

MandrakeSoft Corporate Server 4.0 x86_64

• Mandriva graphviz-2.2.1-3.2.20060mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviz7-2.2.1-3.2.20060mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviz7-devel-2.2.1-3.2.20060mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviztcl7-2.2.1-3.2.20060mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64graphviztcl7-devel-2.2.1-3.2.20060mdk.x86_64.rpm
  http://www.mandriva.com/en/download/

Graphviz Graph Parser Remote Stack Buffer Overflow Vulnerability

References:

• Graphviz Buffer Overflow Code Execution (Roee Hay)
  
• Graphviz Homepage (Graphviz)
  
• Advisory: Graphviz Buffer Overflow Code Execution ([email protected])