SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   GD Library Vendors:   Boutell.com
(Mandrake Issues Fix) GD Library Integer Overflow May Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1012252
SecurityTracker URL:  http://securitytracker.com/id/1012252
CVE Reference:   CVE-2004-0990   (Links to External Site)
Date:  Nov 17 2004
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.0.28
Description:   An integer overflow vulnerability was reported in the GD graphics library. A remote user may be able to execute arbitrary code on the target system.

sean reported that a remote user can create a specially crafted PNG image file to trigger the memory allocation error and subsequently overwrite the heap.

The flaw resides in the gdImageCreateFromPngCtx() function in 'gd_png.c', where user-supplied rowbytes and height values are multiplied and used to incorrectly allocate a pointer array.

The vendor has been notified.

Impact:   A remote user may be able to execute arbitrary code on the target system. The specific impact depends on the application using the library.
Solution:   Mandrake has released a fix.

Mandrakelinux 10.0:
b6eb93a2c4fabb8936d0578e43fc7327 10.0/RPMS/libgd2-2.0.15-4.2.100mdk.i586.rpm
36adb13537ee43cabee3e7db0e067668 10.0/RPMS/libgd2-devel-2.0.15-4.2.100mdk.i586.rpm
f2289ae098ee0a1c85a11f453fb23b98 10.0/RPMS/libgd2-static-devel-2.0.15-4.2.100mdk.i586.rpm
3d8787e36d9c9f1428e45be2be21063f 10.0/RPMS/gd-utils-2.0.15-4.2.100mdk.i586.rpm
154b61cd0fb0681ec0c4b9beed816cf9 10.0/SRPMS/gd-2.0.15-4.1.100mdk.src.rpm

Mandrakelinux 10.0/AMD64:
2bcfff6fde9131c316e538b5983cc233 amd64/10.0/RPMS/lib64gd2-2.0.15-4.1.100mdk.amd64.rpm
931a7b7daa74ebf171ae5f17d4b86721 amd64/10.0/RPMS/lib64gd2-devel-2.0.15-4.1.100mdk.amd64.rpm
7380075c46c95746ec00d5f093a056ed amd64/10.0/RPMS/lib64gd2-static-devel-2.0.15-4.1.100mdk.amd64.rpm
421162b00057727cb7cf12bc1e4f7536 amd64/10.0/RPMS/gd-utils-2.0.15-4.1.100mdk.amd64.rpm
154b61cd0fb0681ec0c4b9beed816cf9 amd64/10.0/SRPMS/gd-2.0.15-4.1.100mdk.src.rpm

Mandrakelinux 10.1:
b4d51324675c2b15f389bad27aa071a6 10.1/RPMS/libgd2-2.0.27-3.2.101mdk.i586.rpm
9a92ae816adcdf4f64999e858344a347 10.1/RPMS/libgd2-devel-2.0.27-3.2.101mdk.i586.rpm
b1c5d2e9512dbd94afa8c0cbe8499147 10.1/RPMS/libgd2-static-devel-2.0.27-3.2.101mdk.i586.rpm
96102ceb0381433cebbc1a0503ce9f0b 10.1/RPMS/gd-utils-2.0.27-3.2.101mdk.i586.rpm
ac871bb517ad1b1ff9693cde22a2ae7f 10.1/SRPMS/gd-2.0.27-3.2.101mdk.src.rpm

Mandrakelinux 10.1/X86_64:
959cc1b6cd424a2acedc36dc76ff7d8a x86_64/10.1/RPMS/lib64gd2-2.0.27-3.2.101mdk.x86_64.rpm
689f6f6b7c20c4499153d3ef959c513b x86_64/10.1/RPMS/lib64gd2-devel-2.0.27-3.2.101mdk.x86_64.rpm
e66c212cfe13192c6dddf3b6b6d216b1 x86_64/10.1/RPMS/lib64gd2-static-devel-2.0.27-3.2.101mdk.x86_64.rpm
0d7807aa1cfac9fec6d230d807a807c4 x86_64/10.1/RPMS/gd-utils-2.0.27-3.2.101mdk.x86_64.rpm
ac871bb517ad1b1ff9693cde22a2ae7f x86_64/10.1/SRPMS/gd-2.0.27-3.2.101mdk.src.rpm

Corporate Server 2.1:
44a7d62d7eac70e87f41ee274a4abc33 corporate/2.1/RPMS/libgd1-1.8.4-7.2.C21mdk.i586.rpm
d40ffe30d2d8a374255ae5d1b834c7eb corporate/2.1/RPMS/libgd1-devel-1.8.4-7.2.C21mdk.i586.rpm
643951fb95b49a6c8d104849b022c47a corporate/2.1/RPMS/gd-utils-1.8.4-7.2.C21mdk.i586.rpm
6925a26a2ae1200be8a33a6c7984e86b corporate/2.1/SRPMS/gd-1.8.4-7.2.C21mdk.src.rpm

Corporate Server 2.1/x86_64:
3be337b38e6c3dfe8cbf647c11e9bb85 x86_64/corporate/2.1/RPMS/libgd1-1.8.4-7.2.C21mdk.x86_64.rpm
03373a2561f7e2672f55bc61d3bcd7f2 x86_64/corporate/2.1/RPMS/libgd1-devel-1.8.4-7.2.C21mdk.x86_64.rpm
40785a373473ebbfbb22d64dae85712c x86_64/corporate/2.1/RPMS/gd-utils-1.8.4-7.2.C21mdk.x86_64.rpm
6925a26a2ae1200be8a33a6c7984e86b x86_64/corporate/2.1/SRPMS/gd-1.8.4-7.2.C21mdk.src.rpm

Mandrakelinux 9.2:
1a2e4110e69423467f793d1cadaa185a 9.2/RPMS/libgd2-2.0.15-3.2.92mdk.i586.rpm
a496a59804a42143763972a8a72a7569 9.2/RPMS/libgd2-devel-2.0.15-3.2.92mdk.i586.rpm
4b50026a3d7751101381a5efea737979 9.2/RPMS/libgd2-static-devel-2.0.15-3.2.92mdk.i586.rpm
911541635d8333e823600632c375de1b 9.2/RPMS/gd-utils-2.0.15-3.2.92mdk.i586.rpm
dac4c98842eb22fcabf5d4827e5f4932 9.2/SRPMS/gd-2.0.15-3.2.92mdk.src.rpm

Mandrakelinux 9.2/AMD64:
85b6214c81f804607585f08b5632e8d5 amd64/9.2/RPMS/lib64gd2-2.0.15-3.2.92mdk.amd64.rpm
37c0dab669ef7718558df3a46d599935 amd64/9.2/RPMS/lib64gd2-devel-2.0.15-3.2.92mdk.amd64.rpm
1ce580670ae7731cf6aa3cdfa250ffb8 amd64/9.2/RPMS/lib64gd2-static-devel-2.0.15-3.2.92mdk.amd64.rpm
a85596a01e66b30ce225f563c52dc654 amd64/9.2/RPMS/gd-utils-2.0.15-3.2.92mdk.amd64.rpm
dac4c98842eb22fcabf5d4827e5f4932 amd64/9.2/SRPMS/gd-2.0.15-3.2.92mdk.src.rpm

Vendor URL:  www.boutell.com/gd/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Mandriva/Mandrake)
Underlying OS Comments:  10.0, 10.1, 9.2, Corporate Server 2.1

Message History:   This archive entry is a follow-up to the message listed below.
Oct 26 2004 GD Library Integer Overflow May Let Remote Users Execute Arbitrary Code



 Source Message Contents

Subject:  [Security Announce] MDKSA-2004:132 - Updated gd packages fix


This is a multi-part message in MIME format...

------------=_1100710418-1263-5018

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
 _______________________________________________________________________

 Package name:           gd
 Advisory ID:            MDKSA-2004:132
 Date:                   November 15th, 2004

 Affected versions:	 10.0, 10.1, 9.2, Corporate Server 2.1
 ______________________________________________________________________

 Problem Description:

 Integer overflows were reported in the GD Graphics Library (libgd)
 2.0.28, and possibly other versions. These overflows allow remote
 attackers to  cause a denial of service and possibly execute arbitrary
 code via PNG image files with large image rows values that lead to a
 heap-based buffer overflow in the gdImageCreateFromPngCtx() function. 
 
 The updated packages have been patched to prevent these issues.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0990
  http://www.securityfocus.com/archive/1/379382/2004-10-24/2004-10-30/0
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 b6eb93a2c4fabb8936d0578e43fc7327  10.0/RPMS/libgd2-2.0.15-4.2.100mdk.i586.rpm
 36adb13537ee43cabee3e7db0e067668  10.0/RPMS/libgd2-devel-2.0.15-4.2.100mdk.i586.rpm
 f2289ae098ee0a1c85a11f453fb23b98  10.0/RPMS/libgd2-static-devel-2.0.15-4.2.100mdk.i586.rpm
 3d8787e36d9c9f1428e45be2be21063f  10.0/RPMS/gd-utils-2.0.15-4.2.100mdk.i586.rpm
 154b61cd0fb0681ec0c4b9beed816cf9  10.0/SRPMS/gd-2.0.15-4.1.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 2bcfff6fde9131c316e538b5983cc233  amd64/10.0/RPMS/lib64gd2-2.0.15-4.1.100mdk.amd64.rpm
 931a7b7daa74ebf171ae5f17d4b86721  amd64/10.0/RPMS/lib64gd2-devel-2.0.15-4.1.100mdk.amd64.rpm
 7380075c46c95746ec00d5f093a056ed  amd64/10.0/RPMS/lib64gd2-static-devel-2.0.15-4.1.100mdk.amd64.rpm
 421162b00057727cb7cf12bc1e4f7536  amd64/10.0/RPMS/gd-utils-2.0.15-4.1.100mdk.amd64.rpm
 154b61cd0fb0681ec0c4b9beed816cf9  amd64/10.0/SRPMS/gd-2.0.15-4.1.100mdk.src.rpm

 Mandrakelinux 10.1:
 b4d51324675c2b15f389bad27aa071a6  10.1/RPMS/libgd2-2.0.27-3.2.101mdk.i586.rpm
 9a92ae816adcdf4f64999e858344a347  10.1/RPMS/libgd2-devel-2.0.27-3.2.101mdk.i586.rpm
 b1c5d2e9512dbd94afa8c0cbe8499147  10.1/RPMS/libgd2-static-devel-2.0.27-3.2.101mdk.i586.rpm
 96102ceb0381433cebbc1a0503ce9f0b  10.1/RPMS/gd-utils-2.0.27-3.2.101mdk.i586.rpm
 ac871bb517ad1b1ff9693cde22a2ae7f  10.1/SRPMS/gd-2.0.27-3.2.101mdk.src.rpm

 Mandrakelinux 10.1/X86_64:
 959cc1b6cd424a2acedc36dc76ff7d8a  x86_64/10.1/RPMS/lib64gd2-2.0.27-3.2.101mdk.x86_64.rpm
 689f6f6b7c20c4499153d3ef959c513b  x86_64/10.1/RPMS/lib64gd2-devel-2.0.27-3.2.101mdk.x86_64.rpm
 e66c212cfe13192c6dddf3b6b6d216b1  x86_64/10.1/RPMS/lib64gd2-static-devel-2.0.27-3.2.101mdk.x86_64.rpm
 0d7807aa1cfac9fec6d230d807a807c4  x86_64/10.1/RPMS/gd-utils-2.0.27-3.2.101mdk.x86_64.rpm
 ac871bb517ad1b1ff9693cde22a2ae7f  x86_64/10.1/SRPMS/gd-2.0.27-3.2.101mdk.src.rpm

 Corporate Server 2.1:
 44a7d62d7eac70e87f41ee274a4abc33  corporate/2.1/RPMS/libgd1-1.8.4-7.2.C21mdk.i586.rpm
 d40ffe30d2d8a374255ae5d1b834c7eb  corporate/2.1/RPMS/libgd1-devel-1.8.4-7.2.C21mdk.i586.rpm
 643951fb95b49a6c8d104849b022c47a  corporate/2.1/RPMS/gd-utils-1.8.4-7.2.C21mdk.i586.rpm
 6925a26a2ae1200be8a33a6c7984e86b  corporate/2.1/SRPMS/gd-1.8.4-7.2.C21mdk.src.rpm

 Corporate Server 2.1/x86_64:
 3be337b38e6c3dfe8cbf647c11e9bb85  x86_64/corporate/2.1/RPMS/libgd1-1.8.4-7.2.C21mdk.x86_64.rpm
 03373a2561f7e2672f55bc61d3bcd7f2  x86_64/corporate/2.1/RPMS/libgd1-devel-1.8.4-7.2.C21mdk.x86_64.rpm
 40785a373473ebbfbb22d64dae85712c  x86_64/corporate/2.1/RPMS/gd-utils-1.8.4-7.2.C21mdk.x86_64.rpm
 6925a26a2ae1200be8a33a6c7984e86b  x86_64/corporate/2.1/SRPMS/gd-1.8.4-7.2.C21mdk.src.rpm

 Mandrakelinux 9.2:
 1a2e4110e69423467f793d1cadaa185a  9.2/RPMS/libgd2-2.0.15-3.2.92mdk.i586.rpm
 a496a59804a42143763972a8a72a7569  9.2/RPMS/libgd2-devel-2.0.15-3.2.92mdk.i586.rpm
 4b50026a3d7751101381a5efea737979  9.2/RPMS/libgd2-static-devel-2.0.15-3.2.92mdk.i586.rpm
 911541635d8333e823600632c375de1b  9.2/RPMS/gd-utils-2.0.15-3.2.92mdk.i586.rpm
 dac4c98842eb22fcabf5d4827e5f4932  9.2/SRPMS/gd-2.0.15-3.2.92mdk.src.rpm

 Mandrakelinux 9.2/AMD64:
 85b6214c81f804607585f08b5632e8d5  amd64/9.2/RPMS/lib64gd2-2.0.15-3.2.92mdk.amd64.rpm
 37c0dab669ef7718558df3a46d599935  amd64/9.2/RPMS/lib64gd2-devel-2.0.15-3.2.92mdk.amd64.rpm
 1ce580670ae7731cf6aa3cdfa250ffb8  amd64/9.2/RPMS/lib64gd2-static-devel-2.0.15-3.2.92mdk.amd64.rpm
 a85596a01e66b30ce225f563c52dc654  amd64/9.2/RPMS/gd-utils-2.0.15-3.2.92mdk.amd64.rpm
 dac4c98842eb22fcabf5d4827e5f4932  amd64/9.2/SRPMS/gd-2.0.15-3.2.92mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFBm3n2mqjQ0CJFipgRAoqiAKDaiK4OIa1Fn23MrPHB6fcW5HK1lgCg7uf0
GoH8NtXyx9/1ASFOkQ41J0A=
=3YB6
-----END PGP SIGNATURE-----


------------=_1100710418-1263-5018
Content-Type: text/plain; name="message.footer"
Content-Disposition: inline; filename="message.footer"
Content-Transfer-Encoding: 8bit

____________________________________________________
Want to buy your Pack or Services from MandrakeSoft? 
Go to http://www.mandrakestore.com
Join the Club : http://www.mandrakeclub.com
____________________________________________________

------------=_1100710418-1263-5018--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC