[Bug 216706] New: CVE-2006-5793 libpng, libpng10 DoS

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.




https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=216706

           Summary: CVE-2006-5793 libpng, libpng10 DoS
           Product: Fedora Core
           Version: fc6
          Platform: All
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: normal
         Component: libpng
        AssignedTo: tgl(a)redhat.com
        ReportedBy: ville.skytta(a)iki.fi
                CC: [e-mail],mclasen(a)redhat.com


+++ This bug was initially created as a clone of Bug #215405 +++

Tavis Ormandy told vendor-sec about a OOB memory read flaw in libpng.  This flaw
is a denial of service flaw.

quoting the mail from Tavis:

    Hello, there's a typo in the sPLT chunk handling code in libpng,
    potentially resulting in an OOB read. AFAICT, the extent of the
    vulnerability is denial of service, but would appreciate a second pair
    of eyes to verify.

    Around line ~983 of pngset.c, in png_set_sPLT()

    to->entries =3D (png_sPLT_entryp)png_malloc(png_ptr,=20
        from->nentries * png_sizeof(png_sPLT_t));

    should be `png_sizeof(png_sPLT_entry)`

    and the same on this line:

    png_memcpy(to->entries, from->entries,
        from->nentries * png_sizeof(png_sPLT_t));

This issue also affects RHEL2.1 and RHEL3

-- Additional comment from bressers(a)redhat.com on 2006-11-14 16:28 EST --
This issue is now public:
http://bugs.gentoo.org/show_bug.cgi?id=154380

---

Possibly affected: libpng in FC5, FC6, and devel, and libpng10 in FC5. 
(libpng10 in Extras has been updated, see bug 216263)

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Till Maas]

The core maintainer of libpng did not respond for a month to another security 
related bug:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=211705

According to the reporter it describes a bug that is now already nearly 5 
months known. Please do something now to fix this,

Regards,
Till

[Josh Bressers]

>  
>  The core maintainer of libpng did not respond for a month to another
>  security related bug:
>  
>  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=211705
>  
>  According to the reporter it describes a bug that is now already nearly 5
>  months known. Please do something now to fix this,
>   
I'm going to presume you're claiming that since Fedora Core doesn't have
the latest libpng, it's vulnerable to the issues fixed in the upstream
new version.

libpng in Fedora Core has all relevant security issues backported into it.
CVE-2006-5793 is not currently fixed, but I suspect we won't be fixing it
as it's simply a client crash and should not have been called a security
issue in the first place.  Even if we do consider it a security flaw, it
represents an extremely low severity flaw.

If you have concerns regarding a specific issue, feel free to bring that
up, but bug 211705 in no way represents a security flaw.

-- 
    JB

[Till Maas]

On Wednesday 22 November 2006 19:00, Josh Bressers wrote:

>  I'm going to presume you're claiming that since Fedora Core
> doesn't have
>  the latest libpng, it's vulnerable to the issues fixed in the upstream
>  new version. 
Actually I downloaded the libpng src.rpm with yumdownloader --source libpng 
and took a look into it, it contains the spec, the upstream tarball and two 
patches:

libpng-1.2.10-multilib.patch
libpng-1.2.10-pngconf.patch

Description of CVE-2006-3334
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3334
| Buffer overflow in the png_decompress_chunk function in pngrutil.c in libpng
| before 1.2.12 allows context-dependent attackers to cause a denial of
| service and possibly execute arbitrary code via unspecified vectors related
| to "chunk error processing," possibly involving the "chunk_name".

>  libpng in Fedora Core has all relevant security issues backported
> into it. 
$ grep pngrutil.c libpng-1.2.10-pngconf.patch libpng-1.2.10-multilib.patch
$ 

So it is not backported.

The libpng homepage also states for release 1.2.12:
| The same releases (and their immediate predecessors) also fix an
| out-of-bounds (by one) memory read and a second buffer overrun, this one in
| the code that writes the sCAL ("physical scale of subject") chunk (which is
| rather rare in any case).   

The patch for this is not backported, either.

I do not know how relevant above vulnerabilites are, since novel states that 
CVE-2006-3334 is not that important in 
http://www.novell.com/linux/security/advisories/2006_16_sr.html

>  If you have concerns regarding a specific issue, feel free to bring
> that
>  up, but bug 211705 in no way represents a security flaw. 
But if the mentioned issues are no security flaws please document it in 
bugzilla, so it does not seem to be ignored.

Regards,
Till

[Josh Bressers]

Sorry for the horribly delayed response.  I've been away on holiday.

>  
>  Actually I downloaded the libpng src.rpm with yumdownloader --source
>  libpng and took a look into it, it contains the spec, the upstream
>  tarball and two patches:
>  
>  libpng-1.2.10-multilib.patch
>  libpng-1.2.10-pngconf.patch
>   
All known libpng CVE ids are tracked via the following files:
http://cvs.fedora.redhat.com/viewcvs/fedora-security/audit/?root=fedora

If there are any CVE ids we're missing please let us know.  There are a
number of CVE ids that are simply client crashes.  We do not consider
client side crashes security issues, they are bugs.  Some of them get CVE
ids.  This is something MITRE is currently working on a policy for.  Right
now they have a blanket policy of assigning a CVE id to anything anyone
calls a security flaw.  It's then our job to weed through them and find the
relevant ones.

>  
>  > If you have concerns regarding a specific issue, feel free to bring that
>  > up, but bug 211705 in no way represents a security flaw.
>  
>  But if the mentioned issues are no security flaws please document it in=20
>  bugzilla, so it does not seem to be ignored.
>   
I've updated that bug with a statement regarding those CVE ids.  The two
mentioned in the bug are client crashes, thus are just bugs.

Thanks.

-- 
    JB

[Till Maas]

On Wednesday 29 November 2006 21:16, Josh Bressers wrote:
>  Sorry for the horribly delayed response.  I've been away on
> holiday. 
I hope you enjoyed your holiday and thanks for responding and answering to the 
bugzilla ticket,

Regards,
Till

[Bug 216706] CVE-2006-5793 libpng, libpng10 DoS

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.

Summary: CVE-2006-5793 libpng, libpng10 DoS


https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=216706


tgl(a)redhat.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|                            |RAWHIDE




------- Additional Comments From tgl(a)redhat.com  2007-02-12 11:27 EST -------
libpng is updated to 1.2.16 for Fedora 7.  As per bz #211705, the security issue
is not considered serious enough to warrant back-patching.

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.