Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2015-8126: Multiple buffer overflows in libpng

web.nvd.nist.gov

Post reply on HN
Print view View original

1–10 of 88 posts

Re: CVE-2015-8126: Multiple buffer overflows in libpng

#3

Post by jimrandomh »

Uh oh. It's time for the monthly global computer security meltdown. Again, but worse this time. Security vulnerabilities in libpng are a huge deal; they affect lots and lots of different programs, including things people don't usually think of, and many them embed their own copies of libpng which makes them hard to update. The last time there was a security vulnerability in libpng, it took years before it was fixed everywhere.

Patching this properly will require not just replacing a centralized copy of libpng, but scanning all binaries for statically-linked copies. There might be some tools left over from the last time libpng got into trouble; this would be a very good time to update and link to them. Some categories of software that are at particularly high risk right now:

* Web browsers. Sandboxing likely helps, but there's a possibility that there are some usages (eg favicons) that decode outside the sandbox.

* MMS on Android (possibly remote root on phones with no user interaction)

* Any server that accepts PNG uploads and processes them (eg, user avatar thumbnail generation)

* Anything which shows people user-provided avatar images (eg, IM clients)

* Video games which download levels that can contain images

* File browsers which show image previews

* Music players which display album covers

Expect malicious images to start appearing everywhere, and soon. If you're responsible for the computer security anywhere, this is a drop-everything priority.

Re: CVE-2015-8126: Multiple buffer overflows in libpng

#5

Post by heinrich5991 »

jimrandomh wrote: post #3

Uh oh. It's time for the monthly global computer security meltdown. Again, but worse this time. Security vulnerabilities in libpng are a huge deal; they affect lots and lots of different programs, including things people don't usually think of, and many them embed their own copies of libpng which makes them hard to update. The last time there was a security vulnerability in libpng, it took years before it was fixed e…

Is this more than a denial of service due to crashes?

Re: CVE-2015-8126: Multiple buffer overflows in libpng

#6

Post by packetized »

deanclatworthy wrote: post #4

What are the practical implications of this?

No input validation in the IHDR as to the number of bits in the palette of the image. As I understand it, you just create an arbitrary image with the palette in the IHDR tweaked to a large number of bits, and watch as the process dies while trying to malloc() enough space to handle a palette that large.

http://seclists.org/oss-sec/2015/q4/264

Re: CVE-2015-8126: Multiple buffer overflows in libpng

#7

Post by cbhl »

heinrich5991 wrote: post #5
jimrandomh wrote: post #3

Uh oh. It's time for the monthly global computer security meltdown. Again, but worse this time. Security vulnerabilities in libpng are a huge deal; they affect lots and lots of different programs, including things people don't usually think of, and many them embed their own copies of libpng which makes them hard to update. The last time there was a security vulnerability in libpng, it took years before it was fixed e…

Is this more than a denial of service due to crashes?

No. Buffer overflows can be used for privilege escalation.

Crashes are better than privilege escalation, but they do not mean that privilege escalation is impossible.

Re: CVE-2015-8126: Multiple buffer overflows in libpng

#8

Post by bennofs »

heinrich5991 wrote: post #5
jimrandomh wrote: post #3

Uh oh. It's time for the monthly global computer security meltdown. Again, but worse this time. Security vulnerabilities in libpng are a huge deal; they affect lots and lots of different programs, including things people don't usually think of, and many them embed their own copies of libpng which makes them hard to update. The last time there was a security vulnerability in libpng, it took years before it was fixed e…

Is this more than a denial of service due to crashes?

I guess the problem is that you don't know:

> allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact

As far as I understand, trying to predict what is possible by exploiting a buffer overflow is hard because it depends on many specifics, such as compiler options used, OS protections, ...

Re: CVE-2015-8126: Multiple buffer overflows in libpng

#9

Post by jimrandomh »

heinrich5991 wrote: post #5
jimrandomh wrote: post #3

Uh oh. It's time for the monthly global computer security meltdown. Again, but worse this time. Security vulnerabilities in libpng are a huge deal; they affect lots and lots of different programs, including things people don't usually think of, and many them embed their own copies of libpng which makes them hard to update. The last time there was a security vulnerability in libpng, it took years before it was fixed e…

Is this more than a denial of service due to crashes?

No one's published an example which causes arbitrary code execution yet (that I'm aware of), but most bugs of this type end up there eventually.
Post reply on HN