Bug 201887 (CVE-2007-3568) – media-libs/imlib < 1.9.15-r2, emul-linux-x86-gtklibs Denial of Service via network with a BMP image (CVE-2007-3568)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Peter Volkov (RETIRED) 2007-12-10 19:39:23 UTC]

Short version: The _LoadBMP function in imlib 1.9.15 and earlier allows context-dependent attackers to cause a denial of service (infinite loop) via a BMP image with a Bits Per Page (BPP) value of 0.

A bit longer:
=====================================================
The information has been provided by beSTORM.
The original article can be found at: http://www.beyondsecurity.com/bestorm_overview.html

Vulnerable Systems:
 * imlib version 1.9.15 and prior

The _LoadBMP function reads from the BMP file the value of BPP (Bits Per Page) and uses that value to know how many bits need to be read at each step of its main file processing loop. The value of 0x0000 (zero) which is invalid, is not properly detected as the line responsible:
if (bpp != 1 && bpp != 4 && bpp != 8 && bpp && 16 && bpp != 24 && bpp != 32)
{
fprintf(stderr, "IMLIB ERROR: unknown bitdepth in file\n");
return NULL;
}


Incorrectly references && bpp && where it shouldn't have probably referenced it at all to prevent the value of 0x0000 from passing.

Since the bpp value of 0x0000 is used, the loop:
  for (line = (*h - 1); line >= 0; line--)
    {
      linepos = 0;
      for (column = 0; column < *w;)
    {

Will never advanced as no case inside the loop matches the bpp value of 0x0000.

Workaround:
Remove the && bpp && from the if statement found at line 648.

Vendor status:
We have tried to contact the security person responsible for the package in Debian, but they haven't addressed it. We have sent an email to the author of imlib on 2007-07-03 but the product appears to be no longer maintained by the author as the last release was released on 2004-09-24.
=====================================================

Although I did not manage to get exploit seems that it's possibile to create one. Thus I'm setting status to major.

[Comment 1 Peter Volkov (RETIRED) 2007-12-10 20:15:16 UTC]

Updated imlib-1.9.15-r2 which includes the fix is in portage. Please, review and proceed as required.

[Comment 2 Peter Volkov (RETIRED) 2007-12-12 20:32:31 UTC]

Assigning on security as this is security issue.

[Comment 3 Pierre-Yves Rofes (RETIRED) 2007-12-12 20:44:22 UTC]

Thanks Peter. Arches, please test and mark stable media-libs/imlib-1.9.15-r2. Target "alpha amd64 arm hppa ia64 mips ppc ppc64 sh sparc x86 ~x86-fbsd"

[Comment 4 Robert Buchholz (RETIRED) 2007-12-13 01:26:12 UTC]

Amd64, this also affects emul-linux-x86-gtklibs. Please update.

[Comment 5 Christian Faulhammer (RETIRED) 2007-12-13 08:35:07 UTC]

x86 stable

[Comment 6 Ferris McCormick (RETIRED) 2007-12-13 16:22:38 UTC]

Stable for sparc.

[Comment 7 Jeroen Roovers (RETIRED) 2007-12-13 17:50:37 UTC]

Stable for HPPA.

[Comment 8 Raúl Porcel (RETIRED) 2007-12-13 20:26:15 UTC]

alpha/ia64 stable

[Comment 9 Peter Weller (RETIRED) 2007-12-14 07:16:34 UTC]

Ebuild stable on amd64, emul stuff yet to come.

[Comment 10 Peter Weller (RETIRED) 2007-12-14 07:40:46 UTC]

Bumped app-emulation/emul-linux-x86-gtklibs - amd64 guys, please test and stable. (If the tarball hasn't yet hit the mirrors, fetch it from here: http://dev.gentoo.org/~welp/emul-linux-x86-gtklibs-20071214.tar.bz2)

[Comment 11 Markus Rothe (RETIRED) 2007-12-14 11:09:13 UTC]

ppc64 stable

[Comment 12 Tobias Scherbaum (RETIRED) 2007-12-14 18:23:14 UTC]

ppc stable

[Comment 13 Peter Weller (RETIRED) 2007-12-15 14:40:00 UTC]

emul-linux-x86-gtklibs-20071214 (which contains the fix) is stable on amd64, thanks to gentoofan23 for testing.

[Comment 14 Robert Buchholz (RETIRED) 2007-12-18 23:43:19 UTC]

Ready for glsa vote.

[Comment 15 Robert Buchholz (RETIRED) 2007-12-19 03:29:43 UTC]

Since this library and function is very unlikely to be called from remote, I vote NO here.

[Comment 16 Pierre-Yves Rofes (RETIRED) 2007-12-19 08:44:23 UTC]

no too, and closing.

[Comment 17 Peter Volkov (RETIRED) 2008-03-06 09:58:27 UTC]

Does not affect current (2008.0) release. Removing release.