Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of service (process crash) and execute arbitrary code via a crafted executable.

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4695-1 advisory.

  - Integer overflow in the wrestool program in icoutils before 0.31.1 allows remote attackers to cause a     denial of service (memory corruption) via a crafted executable, which triggers a denial of service     (application crash) or the possibility of execution of arbitrary code. (CVE-2017-5208)

  - Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows     local users to cause a denial of service (process crash) and execute arbitrary code via a crafted     executable. (CVE-2017-5331)

  - The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access     unallocated memory, which allows local users to cause a denial of service (process crash) and execute     arbitrary code via a crafted executable. (CVE-2017-5332)

  - Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils     before 0.31.1 allows local users to cause a denial of service (process crash) or execute arbitrary code     via a crafted executable file. (CVE-2017-5333)

  - An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the decode_ne_resource_id     function in the restable.c source file. This is happening because the len parameter for memcpy is not     checked for size and thus becomes a negative integer in the process, resulting in a failed memcpy. This     affects wrestool. (CVE-2017-6009)

  - An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the extract_icons function     in the extract.c source file. This issue can be triggered by processing a corrupted ico file and will     result in an icotool crash. (CVE-2017-6010)

  - An issue was discovered in icoutils 0.31.1. An out-of-bounds read leading to a buffer overflow was     observed in the simple_vec function in the extract.c source file. This affects icotool.
    (CVE-2017-6011)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that icoutils incorrectly handled memory when processing certain files. If a user or automated system were tricked into opening a specially crafted file, an attacker could cause icoutils to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Choongwoo Han reports :

An exploitable crash exists in the wrestool utility on 64-bit systems where the result of subtracting two pointers exceeds the size of int.

This update for icoutils to version 0.31.1 fixes the following issues :

  - CVE-2017-5208: An integer overflow allows maliciously     crafted files to cause DoS or code execution     (boo#1018756).

  - CVE-2017-5331: Incorrect out of bounds checks in     check_offset allow for DoS or code execution     (boo#1018756).

  - CVE-2017-5332: Missing out of bounds checks in     extract_group_icon_cursor_resource allow for DoS or code     execution (boo#1018756).

  - CVE-2017-5333: Incorrect out of bounds checks in     check_offset allow for DoS or code execution     (boo#1018756).

This new point release fixes a security vulnerability in wrestool. For further details see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850017

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Brief introduction 

CVE-2017-5208

Choongwoo Han reported[0] an exploitable crash in wrestool from icoutils. The command line tools is e.g. used in KDE's metadataparsing.

CVE-2017-5331

It turned out that the correction for CVE-2017-5208 was not enough so an additional correction was needed.

CVE-2017-5332

But as I see it there are still combinations of the arguments which make the test succeed even though the the memory block identified by offset size is not fully inside memory total_size.

CVE-2017-5333

The memory check was not stringent enough on 64 bit systems.

For Debian 7 'Wheezy', these problems have been fixed in version 0.29.1-5deb7u1.

We recommend that you upgrade your icoutils packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several programming errors in the wrestool tool of icoutils, a suite of tools to create and extract MS Windows icons and cursors, allow denial of service or the execution of arbitrary code if a malformed binary is parsed.

ID	Name	Product	Family	Severity
145046	Ubuntu 16.04 LTS : icoutils vulnerabilities (USN-4695-1)	Nessus	Ubuntu Local Security Checks	high
96763	Ubuntu 12.04 LTS : icoutils vulnerabilities (USN-3178-1)	Nessus	Ubuntu Local Security Checks	high
96619	FreeBSD : icoutils -- check_offset overflow on 64-bit systems (57facd35-ddf6-11e6-915d-001b3856973b)	Nessus	FreeBSD Local Security Checks	high
96578	openSUSE Security Update : icoutils (openSUSE-2017-105)	Nessus	SuSE Local Security Checks	high
96573	Fedora 24 : icoutils (2017-7c221d6f49)	Nessus	Fedora Local Security Checks	high
96572	Fedora 25 : icoutils (2017-3d7734a8b2)	Nessus	Fedora Local Security Checks	high
96570	Debian DLA-789-1 : icoutils security update	Nessus	Debian Local Security Checks	high
96547	openSUSE Security Update : icoutils (openSUSE-2017-104)	Nessus	SuSE Local Security Checks	high
96546	openSUSE Security Update : icoutils (openSUSE-2017-103)	Nessus	SuSE Local Security Checks	high
96498	Debian DSA-3765-1 : icoutils - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-5331

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high