Bug 873124 (CVE-2013-7353) - VUL-0: CVE-2013-7353: libpng: integer overflow leading to a heap-based buffer overflow in png_set_unknown_chunks()
Summary: VUL-0: CVE-2013-7353: libpng: integer overflow leading to a heap-based buffer...
Status: RESOLVED FIXED
Alias: CVE-2013-7353
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2014-05-12
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/97776/
Whiteboard: maint:released:sle11-sp1:57133 maint:...
Keywords:
Depends on:
Blocks:
 
Reported: 2014-04-11 08:51 UTC by Alexander Bergmann
Modified: 2014-05-28 19:05 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
Testcase. (539 bytes, text/x-csrc)
2014-04-17 13:24 UTC, Petr Gajdos
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2014-04-11 08:51:00 UTC
Via rh#1086514:

An integer overflow leading to a heap-based buffer overflow was found in the png_set_unknown_chunks() API function of libpng. A attacker could create a specially-crafated image file and render it with an application written to explicitly call png_set_unknown_chunks() function, could cause libpng to crash or execute arbitrary code with the permissions of the user running such an application.

The vendor mentions that internal calls use safe values. These issues could potentially affect applications that use the libpng API. Apparently no such applications were identified.

CVE-2013-7353 was assigned to this issue.

Reference:
https://bugzilla.redhat.com/show_bug.cgi?id=1086514
http://sourceforge.net/p/libpng/bugs/199/
http://seclists.org/oss-sec/2014/q2/83
Comment 1 Swamp Workflow Management 2014-04-11 22:00:18 UTC
bugbot adjusting priority
Comment 2 Petr Gajdos 2014-04-17 07:44:53 UTC
Factory and 13.1 is not affected (ver > 1.6.0).
12.3 is affected (ver = 1.5.13).
libpng12 is not affected:
http://sourceforge.net/p/png-mng/mailman/message/32215052/
Comment 3 Petr Gajdos 2014-04-17 13:24:20 UTC
Created attachment 586840 [details]
Testcase.

on 32-bit:

$ gcc -o png_set png_set.c -lpng
$ gdb png_set
(gdb) b pngset.c:1036
Breakpoint 2, png_set_unknown_chunks (png_ptr=0x804b008, info_ptr=0x804ef10, unknowns=0xffffd914, num_unknowns=214748365) at pngset.c:1036
1036	   np = (png_unknown_chunkp)png_malloc_warn(png_ptr,
(gdb) s
png_malloc_warn (png_ptr=0x804b008, size=4) at pngmem.c:624
624	{
[..]
632	   ptr = (png_voidp)png_malloc((png_structp)png_ptr, size);
(gdb) p ptr
$3 = (png_voidp) 0x804f008

Later on back in png_set_unknown_chunks:
1056	      png_unknown_chunkp to = np + info_ptr->unknown_chunks_num + i;
(gdb) p to
$7 = (png_unknown_chunkp) 0x804f008

and
1059	      png_memcpy(to->name, from->name, png_sizeof(from->name));
1060	      to->name[png_sizeof(to->name)-1] = '\0';
1061	      to->size = from->size;
1062	
1063	      /* Note our location in the read or write sequence */
1064	      to->location = (png_byte)(png_ptr->mode & 0xff);
Comment 4 Petr Gajdos 2014-04-17 14:09:36 UTC
Marcus, similar works (= overflow and seems to also write behind allocated fragment) for me for 1.2.51@factory.

Could you please confirm? That would contradict upstream statement from comment 2.
Comment 6 Marcus Meissner 2014-04-24 12:37:00 UTC
sorry for the delay.

It is quite obvious the overflow is in libpng12 too.

openSUSE:Factory/libpng12/libpng-1.2.51/pngset.c:

   np = (png_unknown_chunkp)png_malloc_warn(png_ptr,
       (png_uint_32)((info_ptr->unknown_chunks_num + num_unknowns) *
       png_sizeof(png_unknown_chunk)));

this overflows 32bit via the testcase.
   png_memcpy(np, info_ptr->unknown_chunks,
       info_ptr->unknown_chunks_num * png_sizeof(png_unknown_chunk));

same overflow.

and then it writes into unallocated memory space.

That the testcase segfaults is a good indicator.
Comment 8 Petr Gajdos 2014-04-28 12:07:01 UTC
num_text check submitted:
libpng12: 9sp3, 10sp3, 11, 12, 12.3, 13.1, factory
libpng15: 12.3

I am not convinced that overflow could really happen though. Try create png file that would have so many unknown chunks.
Comment 10 Swamp Workflow Management 2014-04-28 15:08:45 UTC
The SWAMPID for this issue is 57130.
This issue was rated as moderate.
Please submit fixed packages until 2014-05-12.
When done, please reassign the bug to security-team@suse.de.
Patchinfo will be handled by security team.
Comment 11 Swamp Workflow Management 2014-05-02 14:04:59 UTC
openSUSE-SU-2014:0604-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 873123,873124
CVE References: CVE-2013-7353,CVE-2013-7354
Sources used:
openSUSE 11.4 (src):    libpng12-1.2.49-19.1
Comment 12 Swamp Workflow Management 2014-05-07 13:04:32 UTC
openSUSE-SU-2014:0616-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 873123,873124
CVE References: CVE-2013-7353,CVE-2013-7354
Sources used:
openSUSE 12.3 (src):    libpng15-1.5.13-3.5.1
Comment 13 Swamp Workflow Management 2014-05-07 13:05:08 UTC
openSUSE-SU-2014:0618-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 873123,873124
CVE References: CVE-2013-7353,CVE-2013-7354
Sources used:
openSUSE 13.1 (src):    libpng12-1.2.50-6.4.1
openSUSE 12.3 (src):    libpng12-1.2.50-3.6.1
Comment 14 Sebastian Krahmer 2014-05-27 13:28:38 UTC
released
Comment 15 Swamp Workflow Management 2014-05-27 14:04:47 UTC
Update released for: libpng, libpng-devel
Products:
SUSE-CORE 9-SP3-TERADATA (x86_64)
Comment 16 Swamp Workflow Management 2014-05-27 14:05:14 UTC
Update released for: libpng, libpng-debuginfo, libpng-devel
Products:
SLE-DEBUGINFO 10-SP3-TERADATA (x86_64)
SLE-SERVER 10-SP3-TERADATA (x86_64)
Comment 17 Swamp Workflow Management 2014-05-27 14:05:33 UTC
Update released for: libpng-devel, libpng12-0, libpng12-0-debuginfo, libpng12-0-debugsource, libpng3
Products:
SLE-DEBUGINFO 11-SP1-TERADATA (x86_64)
SLE-SERVER 11-SP1-TERADATA (x86_64)
Comment 18 Swamp Workflow Management 2014-05-28 15:31:26 UTC
Update released for: libpng-devel, libpng-devel-32bit, libpng-devel-64bit, libpng12-0, libpng12-0-32bit, libpng12-0-64bit, libpng12-0-debuginfo, libpng12-0-debuginfo-32bit, libpng12-0-debuginfo-64bit, libpng12-0-debuginfo-x86, libpng12-0-debugsource, libpng12-0-x86, libpng3
Products:
SLE-DEBUGINFO 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP3 (i386, x86_64)
SLE-SDK 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP3 (i386, x86_64)
Comment 19 Swamp Workflow Management 2014-05-28 19:05:25 UTC
SUSE-SU-2014:0724-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 873123,873124
CVE References: CVE-2013-7353,CVE-2013-7354
Sources used:
SUSE Linux Enterprise Software Development Kit 11 SP3 (src):    libpng12-0-1.2.31-5.33.1
SUSE Linux Enterprise Server 11 SP3 for VMware (src):    libpng12-0-1.2.31-5.33.1
SUSE Linux Enterprise Server 11 SP3 (src):    libpng12-0-1.2.31-5.33.1
SUSE Linux Enterprise Desktop 11 SP3 (src):    libpng12-0-1.2.31-5.33.1