Heap-based buffer overflow in the compression implementation in OpenEXR 1.2.2 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors.

Several vulnerabilities have been discovered in the OpenEXR image library, which can lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-1720     Drew Yao discovered integer overflows in the preview and     compression code.

  - CVE-2009-1721     Drew Yao discovered that an uninitialised pointer could     be freed in the decompression code.

  - CVE-2009-1722     A buffer overflow was discovered in the compression     code.

Multiple vulnerabilities has been found and corrected in OpenEXR :

Multiple integer overflows in OpenEXR 1.2.2 and 1.6.1 allow context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors that trigger heap-based buffer overflows, related to (1) the Imf::PreviewImage::PreviewImage function and (2) compressor constructors. NOTE: some of these details are obtained from third party information (CVE-2009-1720).

The decompression implementation in the Imf::hufUncompress function in OpenEXR 1.2.2 and 1.6.1 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger a free of an uninitialized pointer (CVE-2009-1721).

Buffer overflow in the compression implementation in OpenEXR 1.2.2 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors (CVE-2009-1722).

This update provides fixes for these vulnerabilities.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

Drew Yao discovered several flaws in the way OpenEXR handled certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-1720, CVE-2009-1721)

It was discovered that OpenEXR did not properly handle certain malformed EXR image files. If a user were tricked into opening a crafted EXR image file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS. (CVE-2009-1722).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.8.  Mac OS X 10.5.8 contains security fixes for the following products : 

  - bzip2
  - CFNetwork
  - ColorSync
  - CoreTypes
  - Dock
  - Image RAW
  - ImageIO
  - Kernel
  - launched
  - Login Window
  - MobileMe
  - Networking
  - XQuery

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.8. 

Mac OS X 10.5.8 contains security fixes for the following products :

  - bzip2
  - CFNetwork
  - ColorSync
  - CoreTypes
  - Dock
  - Image RAW
  - ImageIO
  - Kernel
  - launchd
  - Login Window
  - MobileMe
  - Networking
  - XQuery

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2009-003 applied.

This security update contains fixes for the following products :

  - bzip2
  - ColorSync
  - ImageIO
  - Login Window

ID	Name	Product	Family	Severity
44707	Debian DSA-1842-1 : openexr - several vulnerabilities	Nessus	Debian Local Security Checks	high
43075	Mandriva Linux Security Advisory : OpenEXR (MDVSA-2009:191-1)	Nessus	Mandriva Local Security Checks	high
40982	Ubuntu 8.04 LTS / 8.10 / 9.04 : openexr vulnerabilities (USN-831-1)	Nessus	Ubuntu Local Security Checks	high
5122	Mac OS X 10.5 < 10.5.8 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
40502	Mac OS X 10.5.x < 10.5.8 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
40501	Mac OS X Multiple Vulnerabilities (Security Update 2009-003)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2009-1722

critical

Tenable Plugins

high

high

high

critical

critical

critical