Multiple vulnerabilities in NetPBM 9.20 and earlier, and possibly other versions, may allow remote attackers to cause a denial of service or execute arbitrary code via "maths overflow errors" such as (1) integer signedness errors or (2) integer overflows, which lead to buffer overflows.

Al Viro and Alan Cox discovered several maths overflow errors in NetPBM, a set of graphics conversion tools. These programs are not installed setuid root but are often installed to prepare data for processing. These vulnerabilities may allow remote attackers to cause a denial of service or execute arbitrary code.

Several math overflow errors were found in NetPBM by Al Viro and Alan Cox. While these programs are not installed suid root, they are often used to prepare data for processing. These errors may permit remote attackers to cause a denial of service or execute arbitrary code in any programs or scripts that use these graphics conversion tools.

Updated NetPBM packages are available that fix a number of vulnerabilities in the netpbm libraries.

The netpbm package contains a library of functions that support programs for handling various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps), and others.

During an audit of the NetPBM library, Al Viro, Alan Cox, and Sebastian Krahmer found a number of bugs that are potentially exploitable. These bugs could be exploited by creating a carefully crafted image in such a way that it executes arbitrary code when it is processed by either an application from the netpbm-progs package or an application that uses the vulnerable netpbm library.

One way that an attacker could exploit these vulnerabilities would be to submit a carefully crafted image to be printed, as the LPRng print spooler used by default in Red Hat Linux Advanced Products releases uses netpbm utilities to parse various types of image files.

Users are advised to upgrade to the updated packages, which contain patches that correct these vulnerabilities.

ID	Name	Product	Family	Severity
15100	Debian DSA-263-1 : netpbm-free - math overflow errors	Nessus	Debian Local Security Checks	high
14020	Mandrake Linux Security Advisory : netpbm (MDKSA-2003:036)	Nessus	Mandriva Local Security Checks	high
12367	RHEL 2.1 : netpbm (RHSA-2003:061)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2003-0146

critical

Tenable Plugins

high

high

high