SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Xpdf Vendors:   Glyph and Cog
Xpdf Buffer Overflow in doImage() Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1012646
SecurityTracker URL:  http://securitytracker.com/id/1012646
CVE Reference:   CVE-2004-1125   (Links to External Site)
Date:  Dec 21 2004
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 3.00pl2
Description:   iDEFENSE reported a buffer overflow vulnerability in Xpdf. A remote user can cause arbitrary code to be executed on the target user's system.

It is reported that a remote user can create a specially crafted PDF file that, when viewed by the target user, will trigger an overflow and execute arbitrary code with the privileges of the target user.

The flaw resides in the Gfx::doImage() function in 'xpdf/Gfx.cc', where the maskColors array can be overflowed.

The vendor was notified on November 23, 2004.

The original advisory is available at:

http://www.idefense.com/application/poi/display?id=172&type=vulnerabilities

Impact:   A remote user can create a specially crafted PDF file that, when viewed by the target user, will execute arbitrary code on the target user's system. The code will run with the privileges of the target user.
Solution:   The vendor has issued a fixed version (3.00pl2), available at:

http://www.foolabs.com/xpdf/download.html

Also, a patch is available:

ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.00pl2.patch

Vendor URL:  www.foolabs.com/xpdf/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Dec 23 2004 (KDE Issues Fix for kpdf) Xpdf Buffer Overflow in doImage() Lets Remote Users Execute Arbitrary Code
A fix is available for KDE kpdf.
Dec 29 2004 (Gentoo Issues Fix for GPdf) Xpdf Buffer Overflow in doImage() Lets Remote Users Execute Arbitrary Code
Gentoo has released a fix for GPdf.
Dec 31 2004 (Mandrake Issues Fix for tetex) Xpdf Buffer Overflow in doImage() Lets Remote Users Execute Arbitrary Code
Mandrake has released a fix for tetex.
Dec 31 2004 (Mandrake Issues Fix for KOffice) Xpdf Buffer Overflow in doImage() Lets Remote Users Execute Arbitrary Code
Mandrake has released a fix for KOffice.
Dec 31 2004 (Mandrake Issues Fix for kdegraphics) Xpdf Buffer Overflow in doImage() Lets Remote Users Execute Arbitrary Code
Mandrake has released a fix for kdegraphics.
Jan 3 2005 (Fedora Issues Fix) Xpdf Buffer Overflow in doImage() Lets Remote Users Execute Arbitrary Code
Fedora has released a fix for FC2.
Jan 3 2005 (Fedora Issues Fix for TeTex) Xpdf Buffer Overflow in doImage() Lets Remote Users Execute Arbitrary Code
Fedora has released a fix for FC3.
Jan 10 2005 (Gentoo Issues Fix for pdftohtml) Xpdf Buffer Overflow in doImage() Lets Remote Users Execute Arbitrary Code
Gentoo has released a fix for pdftohtml.
Jan 12 2005 (Gentoo Issues Fix for KPdf and KOffice) Xpdf Buffer Overflow in doImage() Lets Remote Users Execute Arbitrary Code
Gentoo has released a fix for KPdf and KOffice.
Jan 13 2005 (Red Hat Issues Fix) Xpdf Buffer Overflow in doImage() Lets Remote Users Execute Arbitrary Code
Red Hat has released a fix.
Jan 13 2005 (Red Hat Issues Fix for CUPS) Xpdf Buffer Overflow in doImage() Lets Remote Users Execute Arbitrary Code
Red Hat has released a fix for CUPS.
Mar 19 2005 (Red Hat Issues Fix for teTex) Xpdf Buffer Overflow in doImage() Lets Remote Users Execute Arbitrary Code
Red Hat has released a fix for teTeX.



 Source Message Contents

Subject:  iDEFENSE Security Advisory 12.21.04: Multiple Vendor xpdf PDF


Multiple Vendor xpdf PDF Viewer Buffer Overflow Vulnerability 

iDEFENSE Security Advisory 12.21.04
www.idefense.com/application/poi/display?id=172&type=vulnerabilities
December 21, 2004

I. BACKGROUND

Xpdf is an open-source viewer for Portable Document Format (PDF) files.

II. DESCRIPTION

Remote exploitation of a buffer overflow vulnerability in the xpdf PDF 
viewer, as included in multiple Linux distributions, could allow 
attackers to execute arbitrary code as the user viewing a PDF file. The 
offending code can be found in the Gfx::doImage() function in the source

file xpdf/Gfx.cc. 

void Gfx::doImage(Object *ref, Stream *str, GBool inlineImg) {
  Dict *dict;
  int width, height;
  int bits;
  GBool mask;
  GBool invert;
  GfxColorSpace *colorSpace;
  GfxImageColorMap *colorMap;
  Object maskObj;
  GBool haveMask;
  int maskColors[2*gfxColorMaxComps];
  Object obj1, obj2;
  int i;

  ...
    // get the mask
    haveMask = gFalse;
    dict->lookup("Mask", &maskObj);
        if (maskObj.isArray()) {
          for (i = 0; i < maskObj.arrayGetLength(); ++i) {
        maskObj.arrayGet(i, &obj1);
[!]         maskColors[i] = obj1.getInt();
            obj1.free();
          }
          haveMask = gTrue;
        }
  ...
}  


Due to the fact that the loop boundaries are not less than the storage 
area, the maskColors array is eventually filled up. After that, local 
variables and other stack memory is overwritten. This ultimately leads 
to control of program flow and arbitrary code execution.

III. ANALYSIS

The severity of this issue is mitigated by the fact that several of the 
local overwritten variables in doImage() are referenced prior to EIP 
being restored; therefore, before the attack gains control of the target

process. However, an attacker with knowledge of the remote operating 
system can construct and validate a malicious payload before attempting 
exploitation, thus increasing the chances of success. An attacker must 
convince a target user to open the malicious file to exploit this 
vulnerability.

IV. DETECTION

iDEFENSE has confirmed the existence of this vulnerability in version 
3.00 of xpdf. It is suspected previous versions are also vulnerable. 

The following Linux distributions are affected by this vulnerability:

	SUSE Linux 
	Redhat Linux 
	Fedora Linux 
	Debian Linux 
	Gentoo Linux 
	FreeBSD (ports) 
	OpenBSD 

V. WORKAROUND

Only open PDF files from trusted individuals.

VI. VENDOR RESPONSE

A patch to address this vulnerability is available from:

    ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.00pl2.patch

Updated binaries (version 3.00pl2) are available from:

    http://www.foolabs.com/xpdf/download.html

VII. CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
names CAN-2004-1125 to these issues. This is a candidate for inclusion
in the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

VIII. DISCLOSURE TIMELINE

11/23/2004  Initial vendor notification
11/29/2004  Initial vendor response
12/21/2004  Coordinated public disclosure

IX. CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

X. LEGAL NOTICES

Copyright (c) 2004 iDEFENSE, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC