[Bug 504782] New: libpng: Interlaced Images Information Disclosure Vulnerability

[Bug 577951] Review Request:...

[Bug 614047] Review Request:...

Red Hat Bugzilla

Tuesday, 9 June 2009 Tue, 9 Jun '09

7:37 a.m.

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. Summary: libpng: Interlaced Images Information Disclosure Vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=504782 Summary: libpng: Interlaced Images Information Disclosure Vulnerability Product: Security Response Version: unspecified Platform: All OS/Version: Linux Status: NEW Status Whiteboard: source=gentoo,reported=20090606,public=20090604,impact =low? Keywords: Security Severity: medium Priority: medium Component: vulnerability AssignedTo: security-response-team(a)redhat.com ReportedBy: thoger(a)redhat.com CC: paul(a)city-fan.org, lfarkas(a)lfarkas.org, tgl(a)redhat.com, berrange(a)redhat.com, rjones(a)redhat.com, fedora-mingw(a)lists.fedoraproject.org Classification: Other Target Release: --- Quoting Secunia advisory SA35346: http://secunia.com/advisories/35346/ A vulnerability has been reported in libpng, which can be exploited by malicious people to disclose potentially sensitive information. The vulnerability is caused due to an error when processing 1-bit interlaced images. This can be exploited to disclose uninitialised memory via specially crafted images having widths that are not divisible by 8. The vulnerability is reported in versions prior to 1.2.37. -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Show replies by date

Red Hat Bugzilla

Tuesday, 9 June Tue, 9 Jun

7:43 a.m.

New subject: [Bug 504782] libpng: Interlaced Images Information Disclosure Vulnerability

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=504782 Tomas Hoger <thoger(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- External Bug ID| |Gentoo 272970 --- Comment #1 from Tomas Hoger <thoger(a)redhat.com> 2009-06-09 08:43:02 EDT --- Upstream page - http://www.libpng.org/pub/png/libpng.html - contains a rather confusing vulnerability warning: Vulnerability Warning Jeff Phillips reported that several versions of libpng through 1.2.35 contain an uninitialized-memory-read bug that may have security implications. Specifically, 1-bit (2-color) interlaced images whose widths are not divisible by 8 may result in several uninitialized bits at the end of certain rows in certain interlace passes being returned to the user. An application that failed to mask these out-of-bounds pixels might display or process them, albeit presumably with benign results in most cases. This bug may be fixed in version 1.2.36, released 7 May 2009, but the correct fix is in version 1.2.37, released 4 June 2009. Going though 1.2.35 -> 1.2.36 and 1.2.36 -> 1.2.37 diffs, this probably refers to the following changes: Changes in 1.2.36: +version 1.2.36beta02 [March 21, 2009] + Use png_memset() after png_malloc() of big_row_buf when reading an + interlaced file, to avoid a possible UMR. http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng;a=commitdiff;h=... Changes in 1.2.37: +version 1.2.37beta01 [May 12, 2009] + Fixed inconsistency in pngrutil.c, introduced in libpng-1.2.36. The + memset() was using "png_ptr->rowbytes" instead of "row_bytes", which + the corresponding png_malloc() uses (Joe Drew). http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng;a=commitdiff;h=... -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Red Hat Bugzilla

7:48 a.m.

New subject: [Bug 504782] libpng: Interlaced Images Information Disclosure Vulnerability

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=504782 --- Comment #2 from Tomas Hoger <thoger(a)redhat.com> 2009-06-09 08:48:07 EDT --- Created an attachment (id=347014) --> (https://bugzilla.redhat.com/attachment.cgi?id=347014) 1.2.36 change Local copy of: http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng;a=commitdiff;h=... -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Red Hat Bugzilla

7:48 a.m.

New subject: [Bug 504782] libpng: Interlaced Images Information Disclosure Vulnerability

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=504782 --- Comment #3 from Tomas Hoger <thoger(a)redhat.com> 2009-06-09 08:48:51 EDT --- Created an attachment (id=347015) --> (https://bugzilla.redhat.com/attachment.cgi?id=347015) 1.2.37 change Local copy of: http://libpng.git.sourceforge.net/git/gitweb.cgi?p=libpng;a=commitdiff;h=... -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Red Hat Bugzilla

8 a.m.

New subject: [Bug 504782] libpng: Interlaced Images Information Disclosure Vulnerability

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=504782 --- Comment #4 from Fedora Update System <updates(a)fedoraproject.org> 2009-06-09 09:00:20 EDT --- mingw32-libpng-1.2.37-1.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/mingw32-libpng-1.2.37-1.fc10 -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Red Hat Bugzilla

8 a.m.

New subject: [Bug 504782] libpng: Interlaced Images Information Disclosure Vulnerability

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=504782 --- Comment #5 from Fedora Update System <updates(a)fedoraproject.org> 2009-06-09 09:00:25 EDT --- mingw32-libpng-1.2.37-1.fc11 has been submitted as an update for Fedora 11. http://admin.fedoraproject.org/updates/mingw32-libpng-1.2.37-1.fc11 -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Red Hat Bugzilla

8 a.m.

New subject: [Bug 504782] libpng: Interlaced Images Information Disclosure Vulnerability

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=504782 --- Comment #6 from Richard W.M. Jones <rjones(a)redhat.com> 2009-06-09 09:00:50 EDT --- mingw32-libpng packages all done. -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Red Hat Bugzilla

8:42 a.m.

New subject: [Bug 504782] libpng: Interlaced Images Information Disclosure Vulnerability

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=504782 --- Comment #7 from Tom Lane <tgl(a)redhat.com> 2009-06-09 09:42:38 EDT --- Calling this a security issue seems like a bit of a stretch. You can only read portions of individual bytes, you can't control very well which bytes those are, and the whole thing depends on the application's display code being seriously buggy (i.e. showing garbage pixels on the right side of an image). -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Red Hat Bugzilla

11:14 a.m.

New subject: [Bug 504782] libpng: Interlaced Images Information Disclosure Vulnerability

...

Calling this a security issue seems like a bit of a stretch.

Yeah, that was reaction too, when seeing upstream announcement.

...

You can only read portions of individual bytes, you can't control very well which bytes those are, and the whole thing depends on the application's display code being seriously buggy (i.e. showing garbage pixels on the right side of an image).

I believe applications displaying images using libpng were not really assumed attack vector, as those can only show those leaked bytes to the user running application, so that case is non-issue. I guess they may have assumed some automated image processing (such as image conversion using ImageMagick's convert, or CUPS printing) as a vector, though even without checking if any such application can return leaked bytes in some output attacker can see and use, the leak seem rather limited, not easily predictable and not too likely to yield any valuable data. Have you already looked into what application must do wrong to process those garbage pixels at all? -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Red Hat Bugzilla

11:52 a.m.

New subject: [Bug 504782] libpng: Interlaced Images Information Disclosure Vulnerability

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug. https://bugzilla.redhat.com/show_bug.cgi?id=504782 --- Comment #9 from Tom Lane <tgl(a)redhat.com> 2009-06-09 12:52:46 EDT --- Well, it would have to have a bug that causes it to process whole bytes (groups of 8 pixels) without regard to the declared image width. That seems unlikely to escape notice for long so far as "display" actions go. I suppose the most plausible route for an information leak is if the bytes get shoved directly into some other image file (either an output PNG or some other format with similar representational details), and then the attacker manages to get access to that file. I think we've previously decided that bugs in PNG-writing applications aren't really grounds for security responses, and this would effectively be in that category. -- Configure bugmail: https://bugzilla.redhat.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

Red Hat Bugzilla

Friday, 12 June Fri, 12 Jun

3:43 p.m.