[oCERT-2009-009] CamlImages integer overflows

[Andrea Barisani <lcars@xxxxxxxxx>]

#2009-009 CamlImages integer overflows

Description:

CamlImages, an open source image processing library, suffers from several
integer overflows which may lead to a potentially exploitable heap overflow and
result in arbitrary code execution.

The vulnerability is triggered by PNG image parsing, the read_png_file and
read_png_file_as_rgb24 functions do not properly validate the width and height
of the image. Specific PNG images with large width and height can be crafted
to trigger the vulnerability.

Affected version:

CamlImages <= 2.2

Fixed version:

Unfortunately oCERT has been unable to get feedback from CamlImages maintainers
and the package seems unmaintained, it's therefore suggested to avoid
CamlImages usage on production or any environment where strong security is
needed.

Credit: vulnerability report and PoC code received from Tielei Wang
        <wangtielei [at] icst [dot] pku [dot] edu [dot] cn>, ICST-ERCIS.

CVE: CVE-2009-2295

Timeline:

2009-05-21: vulnerability reported received
2009-05-21: contacted camlimages maintainers
2009-06-30: due to lack of feedback oCERT asks reporter to disclose the issue
2009-07-01: reporter agrees to disclosure
2009-07-02: assigned CVE
2009-07-02: advisory release

Permalink:
http://www.ocert.org/advisories/ocert-2009-009.html

-- 
Andrea Barisani |                Founder & Project Coordinator
          oCERT | Open Source Computer Emergency Response Team

<lcars@xxxxxxxxx>                         http://www.ocert.org
 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E
        "Pluralitas non est ponenda sine necessitate"