Re: rPSA-2008-0151-1 libpng

[Liran Cohen]

Anyone has any more info about this?

maybe a tool or a document as of how to test this issue?



Thanks.

Liran


rPath Update Announcements wrote:

> rPath Security Advisory: 2008-0151-1
> Published: 2008-04-29
> Products:
> rPath Linux 1
> rPath Appliance Platform Linux Service 1
>
> Rating: Major
> Exposure Level Classification:
> Indirect User Deterministic Unauthorized Access
> Updated Versions:
> libpng=conary.rpath.com@rpl:1/1.2.26-2.1-1
>
> rPath Issue Tracking System:
> https://issues.rpath.com/browse/RPL-2440
>
> References:
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1382
>
> Description:
> Previous versions of the libpng package may allow indirect attackers
> who provide maliciously crafted PNG images to execute arbitrary code
> in applications that use the libpng library.
>
> http://wiki.rpath.com/Advisories:rPSA-2008-0151
>
> Copyright 2008 rPath, Inc.
> This file is distributed under the terms of the MIT License.
> A copy is available at http://www.rpath.com/permanent/mit-license.html
>


--
Liran Cohen
RCT Internet Solutions
http://www.rct.co.il

http://www.theg.org
http://www.wood-wonders.net
http://www.icon-a.com

[glennrp@gmail.com]

On Apr 30, 11:16 am, th...@rct.co.il (Liran Cohen) wrote:
> Anyone has any more info about this?
>
> maybe a tool or a document as of how to test this issue?

There are 3 sample files at
http://www.simplesystems.org/users/glennrp/zlunk

One, the original file found in the wild contains a zero-length cmOD
chunk.
The zlunk-vpAg.png contains a zero-length (invalid) vpAg chunk. This
chunk
is known to ImageMagick but is not supposed to have zero length. The
other,
zlunk-ubSc-ubUC-ueSc-ueUC.png, contains four different unknown chunks
with the names shown in the filename. "ubSc" means "unknown, before
IDAT,
Safe to copy"; "ubUC" means unknown, before IDAT, Unsafe to Copy", and
the other two are the same but "e" signifies that they appear at the
end
of the datastream, after IDAT.

Glenn