Multiple buffer overflows in pnmtopng in netpbm 10.0 and earlier allow attackers to execute arbitrary code via a crafted PNM file.

This update fixes a buffer overflow in the RGBA-palette code. The bug can be abused to trigger a denial-or-service attack by feeding untrusted data to 'pnmtopng -alpha' (maybe via a remote service like a CGI, mail user agent, etc.) The execution of arbitrary code is theoretically possible but unlikely. Another possible buffer overflow that can occur while handling a textline has been fixed as well.
(CVE-2005-3632)

This is a reissue of an earlier patch to fix version problems with the previous release.

Greg Roelofs discovered and fixed several buffer overflows in pnmtopng which is also included in netpbm, a collection of graphic conversion utilities, that can lead to the execution of arbitrary code via a specially crafted PNM file.

Updated netpbm packages that fix two security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The netpbm package contains a library of functions that support programs for handling various graphics file formats.

A stack based buffer overflow bug was found in the way netpbm converts Portable Anymap (PNM) files into Portable Network Graphics (PNG). A specially crafted PNM file could allow an attacker to execute arbitrary code by attempting to convert a PNM file to a PNG file when using pnmtopng with the '-text' option. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3632 to this issue.

An 'off by one' bug was found in the way netpbm converts Portable Anymap (PNM) files into Portable Network Graphics (PNG). If a victim attempts to convert a specially crafted 256 color PNM file to a PNG file, then it can cause the pnmtopng utility to crash. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3662 to this issue.

All users of netpbm should upgrade to these updated packages, which contain backported patches that resolve these issues.

Two buffer overflows were discovered in the 'pnmtopng' tool, which were triggered by processing an image with exactly 256 colors when using the -alpha option (CVE-2005-3662) or by processing a text file with very long lines when using the -text option (CVE-2005-3632).

A remote attacker could exploit these to execute arbitrary code by tricking an user or an automated system into processing a specially crafted PNM file with pnmtopng.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Greg Roelofs discovered and fixed several buffer overflows in pnmtopng which is also included in netpbm, a collection of graphic conversion utilities, that can lead to the execution of arbitrary code via a specially crafted PNM file.

Multiple buffer overflows in pnmtopng in netpbm 10.0 and earlier allow attackers to execute arbitrary code via a crafted PNM file.
(CVE-2005-3632)

An off-by-one buffer overflow in pnmtopng, when using the -alpha command line option, allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PNM file with exactly 256 colors. (CVE-2005-3662)

The updated packages have been patched to correct this problem.

ID	Name	Product	Family	Severity
41145	SuSE9 Security Update : netpbm (YOU Patch Number 11701)	Nessus	SuSE Local Security Checks	medium
22770	Debian DSA-904-1 : netpbm-free - buffer overflows	Nessus	Debian Local Security Checks	medium
21874	CentOS 3 : netpbm (CESA-2005:843)	Nessus	CentOS Local Security Checks	medium
20636	Ubuntu 4.10 / 5.04 / 5.10 : netpbm-free vulnerabilities (USN-218-1)	Nessus	Ubuntu Local Security Checks	medium
20449	Mandrake Linux Security Advisory : netpbm (MDKSA-2005:217)	Nessus	Mandriva Local Security Checks	medium
20360	RHEL 2.1 / 3 : netpbm (RHSA-2005:843)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2005-3632

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium