pnmtopng in netpbm before 10.25, when using the -trans option, uses uninitialized size and index variables when converting Portable Anymap (PNM) images to Portable Network Graphics (PNG), which might allow attackers to execute arbitrary code by modifying the stack.

A buffer overflow has been identified in the pnmtopng component of the netpbm package, a set of graphics conversion tools. This vulnerability could allow an attacker to execute arbitrary code as a local user by providing a specially crafted PNM file.

The old stable distribution (woody) it not vulnerable to this problem.

Updated netpbm packages that fix a security issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The netpbm package contains a library of functions that support programs for handling various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps) and others.

A bug was found in the way netpbm converts Portable Anymap (PNM) files into Portable Network Graphics (PNG). The usage of uninitialised variables in the pnmtopng code allows an attacker to change stack contents when converting to PNG files with pnmtopng using the '-trans' option. This may allow an attacker to execute arbitrary code. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2978 to this issue.

All users of netpbm should upgrade to the updated packages, which contain a backported patch to resolve this issue.

Ubuntu reports :

A buffer overflow was found in the 'pnmtopng' conversion program. By tricking an user (or automated system) to process a specially crafted PNM image with pnmtopng, this could be exploited to execute arbitrary code with the privileges of the user running pnmtopng.

A buffer overflow was found in the 'pnmtopng' conversion program. By tricking an user (or automated system) to process a specially crafted PNM image with pnmtopng, this could be exploited to execute arbitrary code with the privileges of the user running pnmtopng.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Pnmtopng in netpbm 10.2X, when using the -trans option, uses uninitialized size and index variables when converting Portable Anymap (PNM) images to Portable Network Graphics (PNG), which might allow attackers to execute arbitrary code by modifying the stack.

Netpbm 9.2X is not affected by this vulnerability.

The updated packages have been patched to correct this problem.

The remote host is affected by the vulnerability described in GLSA-200510-18 (Netpbm: Buffer overflow in pnmtopng)

    RedHat reported that pnmtopng is vulnerable to a buffer overflow.
  Impact :

    An attacker could craft a malicious PNM file and entice a user to run     pnmtopng on it, potentially resulting in the execution of arbitrary     code with the permissions of the user running pnmtopng.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
22744	Debian DSA-878-1 : netpbm-free - buffer overflow	Nessus	Debian Local Security Checks	high
21965	CentOS 4 : netpbm (CESA-2005:793)	Nessus	CentOS Local Security Checks	high
21493	FreeBSD : netpbm -- buffer overflow in pnmtopng (ae9fb0d7-c4dc-11da-b2fb-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	high
20628	Ubuntu 4.10 / 5.04 / 5.10 : netpbm-free vulnerability (USN-210-1)	Nessus	Ubuntu Local Security Checks	high
20437	Mandrake Linux Security Advisory : netpbm (MDKSA-2005:199)	Nessus	Mandriva Local Security Checks	high
20080	GLSA-200510-18 : Netpbm: Buffer overflow in pnmtopng	Nessus	Gentoo Local Security Checks	high
20058	RHEL 4 : netpbm (RHSA-2005:793)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2005-2978

critical

Tenable Plugins

high

high

high

high

high

high

high