Dia Buffer Overflows in XFig Import Plugin May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1015853
|
|
SecurityTracker URL: http://securitytracker.com/id?1015853
|
|
CVE Reference: CVE-2006-1550
(Links to External Site)
|
Date: Mar 31 2006
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): 0.87 through 0.94; also prior to 0.95-pre6
|
Description: A vulnerability was reported in Dia. A remote user can cause arbitrary code to be executed on the target user's system.
The XFig import plug-in contains several buffer overflows. A remote user can create a specially crafted XFig file that, when loaded
by the target user, can cause arbitrary code to be executed on the target user's system.
infamous41md discovered this vulnerability
during a code review.
|
Impact: A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system.
|
Solution: The vendor has issued a fixed version (0.95-pre6).
Also, a patch for version 0.94 is available at:
http://mail.gnome.org/archives/dia-list/2006-March/msg00149.html
|
Vendor URL: www.gnome.org/projects/dia/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any), Windows (Any)
|
Reported By: lars@raeder.dk
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: 29 Mar 2006 21:27:42 -0000
From: lars@raeder.dk
Subject: Buffer overflows in Dia XFig import
|
A security review kindly performed by infamous41md has turned up three buffer overflow vulnerabilitie
s in the XFig import plug-in
in Dia, a diagramming tool for Gtk that runs on both Winddows and Unix. While the XFig format is no
t the native format of Dia, a
specially crafted XFig file could cause arbitrary code execution *if* loaded into Dia.
The vulnerabilities affect versions 0.87 through 0.94 as well as prereleases 1-5 of 0.95, after which
it is fixed in the source and
later prereleases. A patch against the 0.94 release has been attached to the announcement on the di
a-list at http://mail.gnome.org/archives/dia-list/2006-March/msg00149.html
-Lars Clausen
Head Dia maintainer
|
|
