More big security holes in Linux
March 8, 2008 – 3:38 PMOpen-source developers have warned of serious security holes in two Linux components that could allow attackers to take over a system by tricking a user into viewing a specially crafted image file or opening an archive. Patches exist for the bugs, which affect LHA and imlib.
Imlib, a library for graphics-viewing applications used in the Gnome graphical user environment, contains a bug that could allow the execution of malicious code when a user views a specially crafted bit-map image file, according to Marcus Meissner of Novell Inc.’s Suse Linux. The vulnerability is due to a boundary error in the decoding of runlength-encoded bitmap images, which can be exploited to cause a buffer overflow, according to an advisory from Danish security firm Secunia, which maintains a vulnerabilities database.
Gentoo, MandrakeSoft SA and other Linux vendors have begun distributing fixes for the bug, and a patch is also available from the Gnome project. Imlib 1.x and imlib2 1.x are affected.
The vulnerability is related to last month’s BMP-decoding flaw in Qt, a software toolkit used in writing graphical user interface applications using the X Window system in Unix and Linux, Secunia said.
Linux vendor Red Hat Inc. warned of three security holes in LHA, an utility for compressing and decompressing LHarc-format archives. The bugs, affecting all versions up to and including 1.14, could allow the execution of malicious code if a user were tricked into extracting or testing a malicious archive or passing a specially crafted command line to the lha command. The third bug could allow an attacker to create a directory with shell meta characters in its name which could lead to arbitrary command execution.
Secunia noted that all three of the bugs could be avoided by staying away from untrusted archives. Patches are also available from Red Hat, Gentoo and others.
http://www.infoworld.com/article/04/09/09/HNmorelinuxholes_1.html
You must be logged in to post a comment.