FreeBSD : optipng -- arbitrary code execution via crafted BMP image (2bc960c4-e665-11dd-afcd-00e0815b8da8)

high Nessus Plugin ID 35426

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

Secunia reports :

A vulnerability has been reported in OptiPNG, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error in the BMP reader and can be exploited to cause a buffer overflow by tricking a user into processing a specially crafted file.

Successful exploitation may allow execution of arbitrary code.

Solution

Update the affected package.

See Also

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=505399

http://optipng.sourceforge.net/

http://www.nessus.org/u?4e8ff70f

Plugin Details

Severity: High

ID: 35426

File Name: freebsd_pkg_2bc960c4e66511ddafcd00e0815b8da8.nasl

Version: 1.14

Type: local

Published: 1/20/2009

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:optipng, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 1/19/2009

Vulnerability Publication Date: 11/11/2008

Reference Information

CVE: CVE-2008-5101

CWE: 119

Secunia: 32651