__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN "libpng" Package Vulnerabilities [Red Hat Advisory: RHSA-2004:402-08] August 4, 2004 17:00 GMT Number O-192 [REVISED 5 Aug 2004] [REVISED 6 Aug 2004] [REVISED 10 Aug 2004] [REVISED 18 Aug 2004] [REVISED 29 Aug 2004] ______________________________________________________________________________ PROBLEM: The "libpng" package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files. Buffer overflow, and integer overflow vulnerabilities have been identified. PLATFORM: Red Hat Desktop v.3 Red Hat Enterprise Linux AS, ES, and WS (v.3) Red Hat Enterprise Linux AS, ES, and WS (v.2.1) Debian GNU/Linux 3.0 (woody) HP Tru64 Unix 5.1A and 5.1B Mac OS X 10.3.4 and Mac OS X 10.2.8 DAMAGE: An attacker could carefully craft a PNG file in such a way that it would cause an application linked to libpng to crash or potentially execute arbitrary code when opened by a victim. SOLUTION: Upgrade to the Red Hat package version #25. ______________________________________________________________________________ VULNERABILITY The risk is LOW. An attacker could cause a denial or service or ASSESSMENT: execute arbitrary code when the PNG file is opened by a victim. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/o-192.shtml ORIGINAL BULLETIN: http://rhn.redhat.com/errata/RHSA-2004-402.html ADDITIONAL LINKS: - Red Hat RHSA-2004:421-17 https://rhn.redhat.com/errata/RHSA-2004-421.html - Debian: DSA 536-1 http://www.debian.org/security/2004/dsa-536 - Hewlett Packard: HPSBTU01063 / SSRT4778 - Use HP's Subscription Service to see bulletin - Patch Kit URL: http://h30097.www3.hp.com/unix/security-download.html - Apple Security Update 2004-08-09 http://docs.info.apple.com/article.html?artnum=61798 - SGI Security Advisory 20040803-01-U Update #24 http://www.sgi.com/support/security/advisories.html - Sun Alert ID: 57617 http://au.sunsolve.sun.com/search/document.do?assetkey= 1-26-57617-1 CVE/CAN: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name= CAN-2002-1363 CAN-2004-0597 CAN-2004-0598 CAN-2004-0599 ______________________________________________________________________________ REVISION HISTORY: 8/5/2004 - added link: Red Hat has released some updated packages on their Mozilla Advisory RHSA-2004:421-17 that relate to the "libpng" vulnerabilities. 8/6/2004 - added links: Debian and Hewlett Packard advisories. 08/10/2004 - Added link to Apple Security Updates. 08/18/2004 - Added a link to SGI Security Advisory 20040803-01-U Update #24 for SGI ProPack v2.4. 08/19/2004 - Added a link to Sun Alert ID: 57617 for Solaris 8 & 9, and Sun Java Desktop System (JDS) 1 & 2 for Linux. [***** Start "libpng" Package Vulnerabilities *****] Updated libpng packages fix security issues Advisory: RHSA-2004:402-08 Last updated on: 2004-08-04 Affected Products: Red Hat Desktop (v. 3) Red Hat Enterprise Linux AS (v. 2.1) Red Hat Enterprise Linux AS (v. 3) Red Hat Enterprise Linux ES (v. 2.1) Red Hat Enterprise Linux ES (v. 3) Red Hat Enterprise Linux WS (v. 2.1) Red Hat Enterprise Linux WS (v. 3) Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor CVEs (cve.mitre.org): CAN-2002-1363 CAN-2004-0597 CAN-2004-0598 CAN-2004-0599 Security Advisory Details: Updated libpng packages that fix several issues are now available. The libpng package contains a library of functions for creating and manipulating PNG (Portable Network Graphics) image format files. During a source code audit, Chris Evans discovered several buffer overflows in libpng. An attacker could create a carefully crafted PNG file in such a way that it would cause an application linked with libpng to execute arbitrary code when the file was opened by a victim. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0597 to these issues. In addition, this audit discovered a potential NULL pointer dereference in libpng (CAN-2004-0598) and several integer overflow issues (CAN-2004-0599). An attacker could create a carefully crafted PNG file in such a way that it would cause an application linked with libpng to crash when the file was opened by the victim. Red Hat would like to thank Chris Evans for discovering these issues. For users of Red Hat Enterprise Linux 2.1 these patches also include a more complete fix for the out of bounds memory access flaw (CAN-2002-1363). All users are advised to update to the updated libpng packages which contain backported security patches and are not vulnerable to these issues. Updated packages: Red Hat Desktop (v. 3) ----------------------------------------------------------------------------- AMD64: libpng-1.2.2-25.x86_64.rpm 80265ad8a377cf67f2906994e7b763af libpng-devel-1.2.2-25.x86_64.rpm 188fec715d9a2129f28c775ad3917f7a libpng10-1.0.13-15.x86_64.rpm 006b451f489d3ec09ad39d23099ea0fb libpng10-devel-1.0.13-15.x86_64.rpm e9a385e6c6c14d7575d84f045b01c054 SRPMS: libpng-1.2.2-25.src.rpm 1555047a805d476f63b705865ec6b1a1 libpng10-1.0.13-15.src.rpm 1a1c918f5d8054158036ff82bd6c8bc2 i386: libpng-1.2.2-25.i386.rpm 63095ed0286c8978349ae94621887651 libpng-devel-1.2.2-25.i386.rpm a79e3d8aac72561af368e5655c9dcb13 libpng10-1.0.13-15.i386.rpm 12464295e19c16d1474d1132bc90216e libpng10-devel-1.0.13-15.i386.rpm 347af31b8620742e5e6b18de0c300d62 libpng-1.2.2-25.i386.rpm 63095ed0286c8978349ae94621887651 Red Hat Enterprise Linux AS (v. 2.1) ----------------------------------------------------------------------------- SRPMS: libpng-1.0.14-7.src.rpm 69bba6610f415bd0f21f815db1effbf2 i386: libpng-1.0.14-7.i386.rpm c660a4e7c583306a46a0134ab104f346 libpng-devel-1.0.14-7.i386.rpm 7b2588d5cc492eb84a1c73729303ca4e ia64: libpng-1.0.14-7.ia64.rpm 86e364114c5dedb33c5252b9a3fe6211 libpng-devel-1.0.14-7.ia64.rpm 5201c1e26319d34fb8efa09256007152 Red Hat Enterprise Linux AS (v. 3) ----------------------------------------------------------------------------- AMD64: libpng-1.2.2-25.x86_64.rpm 80265ad8a377cf67f2906994e7b763af libpng-devel-1.2.2-25.x86_64.rpm 188fec715d9a2129f28c775ad3917f7a libpng10-1.0.13-15.x86_64.rpm 006b451f489d3ec09ad39d23099ea0fb libpng10-devel-1.0.13-15.x86_64.rpm e9a385e6c6c14d7575d84f045b01c054 SRPMS: libpng-1.2.2-25.src.rpm 1555047a805d476f63b705865ec6b1a1 libpng10-1.0.13-15.src.rpm 1a1c918f5d8054158036ff82bd6c8bc2 i386: libpng-1.2.2-25.i386.rpm 63095ed0286c8978349ae94621887651 libpng-devel-1.2.2-25.i386.rpm a79e3d8aac72561af368e5655c9dcb13 libpng10-1.0.13-15.i386.rpm 12464295e19c16d1474d1132bc90216e libpng10-devel-1.0.13-15.i386.rpm 347af31b8620742e5e6b18de0c300d62 libpng-1.2.2-25.i386.rpm 63095ed0286c8978349ae94621887651 libpng-1.2.2-25.i386.rpm 63095ed0286c8978349ae94621887651 ia64: libpng-1.2.2-25.ia64.rpm 85c1fa0360af727b4b427aaac90861b7 libpng-devel-1.2.2-25.ia64.rpm 5800ad160885273f270a6b8ecd0b9373 libpng10-1.0.13-15.ia64.rpm 811109452021a7f0bc9d25437caeab97 libpng10-devel-1.0.13-15.ia64.rpm ba359cdb3db036a5b5b45c1a01b21791 ppc: libpng-1.2.2-25.ppc.rpm cbf5617d15939c413b520fcbe0594485 libpng-devel-1.2.2-25.ppc.rpm ddd78dd4e3439cb6cb28e5215e029a81 libpng10-1.0.13-15.ppc.rpm b0810e3f95590836652144165cd7e0cc libpng10-devel-1.0.13-15.ppc.rpm d073fbeeef6874e0ae2238c6ef44ed6e ppc64: libpng-1.2.2-25.ppc64.rpm 5c7387ae952fcc1d4637e2655c9370a3 s390: libpng-1.2.2-25.s390.rpm 0f621fbc3de1d8e4c4490e2baf2f30ef libpng-devel-1.2.2-25.s390.rpm aec3463a236eac2d6d6576120f92eb55 libpng10-1.0.13-15.s390.rpm b4c3c6ee6d699fd51baf9f06f9275443 libpng10-devel-1.0.13-15.s390.rpm afb0ebe6e191e7f71929d30788a11708 libpng-1.2.2-25.s390.rpm 0f621fbc3de1d8e4c4490e2baf2f30ef s390x: libpng-1.2.2-25.s390x.rpm f218fb58aee3535f3f0280c6c6a78dfa libpng-devel-1.2.2-25.s390x.rpm 50d5ecfe73aa1f3a7ef0c41fb8fb79c6 libpng10-1.0.13-15.s390x.rpm 4b2733ffcb3d84295dcfecc36e69faaa libpng10-devel-1.0.13-15.s390x.rpm edf03becdf0b2a6044c85896a005e1c3 Red Hat Enterprise Linux ES (v. 2.1) ----------------------------------------------------------------------------- SRPMS: libpng-1.0.14-7.src.rpm 69bba6610f415bd0f21f815db1effbf2 i386: libpng-1.0.14-7.i386.rpm c660a4e7c583306a46a0134ab104f346 libpng-devel-1.0.14-7.i386.rpm 7b2588d5cc492eb84a1c73729303ca4e Red Hat Enterprise Linux ES (v. 3) ----------------------------------------------------------------------------- AMD64: libpng-1.2.2-25.x86_64.rpm 80265ad8a377cf67f2906994e7b763af libpng-devel-1.2.2-25.x86_64.rpm 188fec715d9a2129f28c775ad3917f7a libpng10-1.0.13-15.x86_64.rpm 006b451f489d3ec09ad39d23099ea0fb libpng10-devel-1.0.13-15.x86_64.rpm e9a385e6c6c14d7575d84f045b01c054 SRPMS: libpng-1.2.2-25.src.rpm 1555047a805d476f63b705865ec6b1a1 libpng10-1.0.13-15.src.rpm 1a1c918f5d8054158036ff82bd6c8bc2 i386: libpng-1.2.2-25.i386.rpm 63095ed0286c8978349ae94621887651 libpng-devel-1.2.2-25.i386.rpm a79e3d8aac72561af368e5655c9dcb13 libpng10-1.0.13-15.i386.rpm 12464295e19c16d1474d1132bc90216e libpng10-devel-1.0.13-15.i386.rpm 347af31b8620742e5e6b18de0c300d62 libpng-1.2.2-25.i386.rpm 63095ed0286c8978349ae94621887651 libpng-1.2.2-25.i386.rpm 63095ed0286c8978349ae94621887651 ia64: libpng-1.2.2-25.ia64.rpm 85c1fa0360af727b4b427aaac90861b7 libpng-devel-1.2.2-25.ia64.rpm 5800ad160885273f270a6b8ecd0b9373 libpng10-1.0.13-15.ia64.rpm 811109452021a7f0bc9d25437caeab97 libpng10-devel-1.0.13-15.ia64.rpm ba359cdb3db036a5b5b45c1a01b21791 Red Hat Enterprise Linux WS (v. 2.1) ----------------------------------------------------------------------------- SRPMS: libpng-1.0.14-7.src.rpm 69bba6610f415bd0f21f815db1effbf2 i386: libpng-1.0.14-7.i386.rpm c660a4e7c583306a46a0134ab104f346 libpng-devel-1.0.14-7.i386.rpm 7b2588d5cc492eb84a1c73729303ca4e Red Hat Enterprise Linux WS (v. 3) ----------------------------------------------------------------------------- AMD64: libpng-1.2.2-25.x86_64.rpm 80265ad8a377cf67f2906994e7b763af libpng-devel-1.2.2-25.x86_64.rpm 188fec715d9a2129f28c775ad3917f7a libpng10-1.0.13-15.x86_64.rpm 006b451f489d3ec09ad39d23099ea0fb libpng10-devel-1.0.13-15.x86_64.rpm e9a385e6c6c14d7575d84f045b01c054 SRPMS: libpng-1.2.2-25.src.rpm 1555047a805d476f63b705865ec6b1a1 libpng10-1.0.13-15.src.rpm 1a1c918f5d8054158036ff82bd6c8bc2 i386: libpng-1.2.2-25.i386.rpm 63095ed0286c8978349ae94621887651 libpng-devel-1.2.2-25.i386.rpm a79e3d8aac72561af368e5655c9dcb13 libpng10-1.0.13-15.i386.rpm 12464295e19c16d1474d1132bc90216e libpng10-devel-1.0.13-15.i386.rpm 347af31b8620742e5e6b18de0c300d62 libpng-1.2.2-25.i386.rpm 63095ed0286c8978349ae94621887651 libpng-1.2.2-25.i386.rpm 63095ed0286c8978349ae94621887651 ia64: libpng-1.2.2-25.ia64.rpm 85c1fa0360af727b4b427aaac90861b7 libpng-devel-1.2.2-25.ia64.rpm 5800ad160885273f270a6b8ecd0b9373 libpng10-1.0.13-15.ia64.rpm 811109452021a7f0bc9d25437caeab97 libpng10-devel-1.0.13-15.ia64.rpm ba359cdb3db036a5b5b45c1a01b21791 Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor ----------------------------------------------------------------------------- SRPMS: libpng-1.0.14-7.src.rpm 69bba6610f415bd0f21f815db1effbf2 ia64: libpng-1.0.14-7.ia64.rpm 86e364114c5dedb33c5252b9a3fe6211 libpng-devel-1.0.14-7.ia64.rpm 5201c1e26319d34fb8efa09256007152 (The unlinked packages above are only available from the Red Hat Network) Solution Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: http://www.redhat.com/docs/manuals/enterprise/ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1363 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0597 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0598 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0599 ---------------------------------------------------------------------------- The listed packages are GPG signed by Red Hat, Inc. for security. Our key is available at: http://www.redhat.com/solutions/security/news/publickey/#key You can verify each package and see who signed it with the following command: rpm --checksig -v filename If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: md5sum filename The Red Hat security contact is security@redhat.com. More contact details at http://www.redhat.com/solutions/security/news/contact.html Copyright © 2002 Red Hat, Inc. All rights reserved. [***** End "libpng" Package Vulnerabilities *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Red Hat Inc. for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) O-182: Microsoft Vulnerability in HTML Help Could Allow Code Execution O-183: Microsoft Vulnerability in Windows Shell Could Allow Remote Code Execution O-184: PHP memory_limit and strip_tags Vulnerabilities O-185: Sun Java System Web Server Cross-site Scripting Vulnerabilitiy O-186: Samba Buffer Overrun Vulnerabilities O-187: 'chown(2)' System Call Vulnerability O-188: libapache-mod-ssl O-189: HP-UX xfs and stmkfont Vulnerabilities O-190: Check Point ASN.1 VPN-1 Buffer Overrun O-191: Microsoft Cumulative Security Update for Internet Explorer (867801)