Bug 152668 – media-gfx/graphicsmagick: PALM and DCM Buffer Overflows (CVE-2006-5456)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Aarni Honka 2006-10-24 09:07:19 UTC]

TITLE:
GraphicsMagick PALM and DCM Buffer Overflows

SECUNIA ADVISORY ID:
SA22569

VERIFY ADVISORY:
http://secunia.com/advisories/22569/

CRITICAL:
Moderately critical

IMPACT:
DoS, System access

WHERE:
From remote

SOFTWARE:
GraphicsMagick 1.x
http://secunia.com/product/3764/

DESCRIPTION:
Some vulnerabilities have been reported in GraphicsMagick, which can
be exploited by malicious people to cause a DoS (Denial of Service)
and potentially compromise a vulnerable system.

1) A boundary error within the "ReadDCMImage()" function in
coders/dcm.c can be exploited to cause a buffer overflow when
processing specially crafted DCM images.

2) Several boundary errors within the "ReadPALMImage()" function in
coders/palm.c can be exploited to cause heap-based buffer overflows
when processing specially crafted PALM images.

Successful exploitation may allow the execution of arbitrary code.

SOLUTION:
Do not open untrusted PALM and DCM images.

PROVIDED AND/OR DISCOVERED BY:
M. Joonas Pihlaja

ORIGINAL ADVISORY:
http://packages.debian.org/changelogs/pool/main/g/graphicsmagick/graphicsmagick_1.1.7-9/changelog#versionversion1.1.7-9

[Comment 1 Matthias Geerdsen (RETIRED) 2006-11-01 08:36:25 UTC]

kloeri, pls provide an updated ebuild

[Comment 2 Bryan Østergaard (RETIRED) 2006-11-04 11:46:38 UTC]

Added 1.1.7-r3 with fixes for dcm and palm coders.

[Comment 3 Matthias Geerdsen (RETIRED) 2006-11-04 11:56:57 UTC]

thanks kloeri

arches, pls test and mark stable if possible


wow... I really thought of using the button this time... ;-)

[Comment 4 Timothy Redaelli (RETIRED) 2006-11-04 12:44:48 UTC]

ppc is safe

[Comment 5 Markus Meier 2006-11-04 16:19:08 UTC]

1. emerges on x86
2. passes collision test
3. seems to work

media-gfx/graphicsmagick-1.1.7-r3  USE="X depth16 depth32 gs jpeg jpeg2k lcms lzw perl png tiff truetype wmf xml -doc -jbig"

Portage 2.1.1-r1 (default-linux/x86/2006.1/desktop, gcc-4.1.1, glibc-2.4-r3, 2.6.18.1 i686)
=================================================================
System uname: 2.6.18.1 i686 Genuine Intel(R) CPU           T2300  @ 1.66GHz
Gentoo Base System version 1.12.6
Last Sync: Fri, 03 Nov 2006 13:50:01 +0000
ccache version 2.3 [disabled]
app-admin/eselect-compiler: [Not Present]
dev-java/java-config: 1.3.7, 2.0.30
dev-lang/python:     2.3.5-r3, 2.4.3-r4
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     2.3
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.60
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.13-r4
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.17-r1
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config /usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips/config/ /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config/ /usr/share/texmf/xdvi/"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/java-config/vms/ /etc/revdep-rebuild /etc/terminfo"
CXXFLAGS="-O2 -march=prescott -pipe -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
EMERGE_DEFAULT_OPTS="--nospinner"
FEATURES="autoconfig collision-protect distlocks metadata-transfer parallel-fetch sandbox sfperms strict test userfetch userpriv usersandbox"
GENTOO_MIRRORS="http://mirror.switch.ch/mirror/gentoo/ http://gentoo.inode.at/"
LINGUAS="en de en_GB de_CH"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="x86 X a52 aac acpi alsa apache2 asf berkdb bitmap-fonts cairo cdr cdrom cli cracklib crypt cups dbus divx dlloader dri dts dvd dvdr dvdread eds elibc_glibc emboss encode fam ffmpeg firefox flac fortran gdbm gif gnome gpm gstreamer gtk hal iconv input_devices_keyboard input_devices_mouse ipv6 isdnlog java jpeg kde kernel_linux ldap libg++ linguas_de linguas_de_CH linguas_en linguas_en_GB mad mikmod mmx mono mp3 mpeg ncurses nls nptl nptlonly ogg opengl oss pam pcre perl png ppds pppd python qt3 qt4 quicktime readline reflection rtsp samba sdl session smp spell spl sse sse2 sse3 ssl svg tcpd test tetex theora threads truetype truetype-fonts type1-fonts udev unicode userland_GNU vcd video_cards_fbdev video_cards_i810 video_cards_vesa vorbis win32codecs wxwindows x264 xine xml xorg xprint xv xvid zlib"
Unset:  CTARGET, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY

[Comment 6 Christian Faulhammer (RETIRED) 2006-11-04 17:30:42 UTC]

x86 wears the heavy armour now

[Comment 7 Markus Rothe (RETIRED) 2006-11-06 04:41:00 UTC]

sorry, my internet connection is broken currently..

ppc64 stable

[Comment 8 Bryan Østergaard (RETIRED) 2006-11-07 14:13:50 UTC]

Stable on ia64.

[Comment 9 Raphael Marichez (Falco) (RETIRED) 2006-11-13 15:20:49 UTC]

GLSA 200611-07, thanks everybody