GLSA
Bodhisattva
Joined: 25 Feb 2003
Posts: 3826
Location: Essen, Germany
|
 Posted: Sun Dec 19, 2004 8:03 pm Post subject: [ GLSA 200412-17 ] kfax: Multiple overflows in the included |
 |
|
Gentoo Linux Security Advisory
Title: kfax: Multiple overflows in the included TIFF library (GLSA 200412-17)
Severity: normal
Exploitable: remote
Date: December 19, 2004
Updated: January 12, 2005
Bug(s): #73795
ID: 200412-17
Synopsis
kfax contains several buffer overflows potentially leading to execution of arbitrary code.
Background
KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. kfax (part of kdegraphics) is the KDE fax file viewer.
Affected Packages
Package: kde-base/kdegraphics
Vulnerable: < 3.3.2
Unaffected: >= 3.3.2
Architectures: All supported architectures
Description
Than Ngo discovered that kfax contains a private copy of the TIFF library and is therefore subject to several known vulnerabilities (see References).
Impact
A remote attacker could entice a user to view a carefully-crafted TIFF image file with kfax, which would potentially lead to execution of arbitrary code with the rights of the user running kfax.
Workaround
The KDE Team recommends to remove the kfax binary as well as the kfaxpart.la KPart: | Code: | | rm /usr/kde/3.*/lib/kde3/kfaxpart.la rm /usr/kde/3.*/bin/kfax |
Note: This will render the kfax functionality useless, if kfax functionality is needed you should upgrade to the KDE 3.3.2 which is not stable at the time of this writing. There is no known workaround at this time.
Resolution
All kfax users should upgrade to the latest version: | Code: | # emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kdegraphics-3.3.2" |
References
KDE Security Advisory: kfax libtiff vulnerabilities
GLSA 200410-11
CAN-2004-0803
CAN-2004-0804
CAN-2004-0886
Last edited by GLSA on Sun May 07, 2006 4:54 pm; edited 1 time in total |
|
News & Announcements
