A good opportunity to check how https://github.com/PistonDevelopers/image-png is doing (a PNG decoder written in Rust). Looks like it includes bindings to use miniz.c for DEFLATE decoding as well as "inflate" (which seems to be DEFLATE in Rust). Also, it seems to have a fuzzing driver (png-afl). Good times!
CVE-2015-8126: Multiple buffer overflows in libpng
11–20 of 88 posts
Re: CVE-2015-8126: Multiple buffer overflows in libpng
#12From CVE: >and 1.6.x before 1.6.19 Unfortunately, the latest version on libpng site [0] is 1.6.18. Why was this CVE announced before the patch and version update was released? [0] http://www.libpng.org/pub/png/libpng.html
The Sourceforge site [0] is up to date:
> UPDATE 12 November 2015:
> The latest released versions are libpng-1.5.24 and libpng-1.6.19 [DOWNLOAD].
Re: CVE-2015-8126: Multiple buffer overflows in libpng
#13Uh oh. It's time for the monthly global computer security meltdown. Again, but worse this time. Security vulnerabilities in libpng are a huge deal; they affect lots and lots of different programs, including things people don't usually think of, and many them embed their own copies of libpng which makes them hard to update. The last time there was a security vulnerability in libpng, it took years before it was fixed e…
The best part about android is that all the important apps are tied together and have to be updated at once. It seems like it really wouldn't be hard to write an MMS worm that stuck around for a while.
Re: CVE-2015-8126: Multiple buffer overflows in libpng
#14Earlier quoted context omitted.
Is this more than a denial of service due to crashes?
I guess the problem is that you don't know: > allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact As far as I understand, trying to predict what is possible by exploiting a buffer overflow is hard because it depends on many specifics, such as compiler options used, OS protections, ...
[deleted]
Re: CVE-2015-8126: Multiple buffer overflows in libpng
#15I wonder if this was found by fuzzing or inspection, because the former seems a quite popular method recently.
I wouldn't be surprised if this is from AFL.
Re: CVE-2015-8126: Multiple buffer overflows in libpng
#16What are the practical implications of this?
Buffer overflows are basically about memory corruption. They can lead to crashes, remote code execution, if run in privileged code to privilege escalation, etc.
Most modern operating systems have buffer overflow protection technologies such as ASLR. I tried recently exploiting a few guaranteed buffer overflows for fun, and it's getting irritatingly hard at least on Linux. Non-executable stack, *alloc functions have sanity checks, -fstack-protector provided canaries, ... It's possible to get past all that, but it takes a bit work.
I would be freaked if I was running some older operating system, and someone vendored a poorly compiled version of libpng. Windows applications are probably the scariest here, especially when run on older Windows servers...
Re: CVE-2015-8126: Multiple buffer overflows in libpng
#17I wonder if this was found by fuzzing or inspection, because the former seems a quite popular method recently.
The bug was found with American Fuzzy Lop from optipng (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=787647) and later the optipng author noticed that the same bug also affects libpng (http://sourceforge.net/p/png-mng/mailman/png-mng-implement/t...)
Re: CVE-2015-8126: Multiple buffer overflows in libpng
#18I just compiled libpng-1.6.19, and then I read this post right after.
XD
Re: CVE-2015-8126: Multiple buffer overflows in libpng
#19From CVE: >and 1.6.x before 1.6.19 Unfortunately, the latest version on libpng site [0] is 1.6.18. Why was this CVE announced before the patch and version update was released? [0] http://www.libpng.org/pub/png/libpng.html
Actually, the patch was announced before the details of the bug: I subscribe to the libpng mailing list, and got about a day's notice to ship the patch out before the CVE and associated details were widely publicised. They did a good job of notifying us quickly, before there was chance for the 'bad guys' to jump on my customers.
Re: CVE-2015-8126: Multiple buffer overflows in libpng
#20Earlier quoted context omitted.
Is this more than a denial of service due to crashes?
No one's published an example which causes arbitrary code execution yet (that I'm aware of), but most bugs of this type end up there eventually.
You'd need an infoleak but from somewhere, but I doubt anyone who has one will come forward.