Bug 59120 (CVE-2004-1726)

from bugtraq: 
Date: Fri, 20 Aug 2004 03:26:05 -0400 
From: infamous41md@hotpop.com 
Subject: XV multiple buffer overflows, exploit included 
 
Program Description: 
 
xv is an interactive image manipulation program for the X Window System. It 
can 
operate on images in the GIF, JPEG, TIFF, PBM, PGM, PPM, XPM, X11 bitmap, Sun 
Rasterfile, Targa, RLE, RGB, BMP, PCX, FITS, and PM formats on all known types 
of X displays. It can generate PostScript files, and if you have ghostscript 
(version 2.6 or above) installed on your machine, it can also display them. 
 
 
Vulnerable Versions: 
 
probably all of them, but I only looked at the newest, 3.10a. 
 
 
Summary: 
 
there are at least 5 exploitable buffer and heap overflows in the image 
handling 
code.  this allows someone to craft a malicious image, trick a user into 
viewing 
the file in xv, and upon viewing that image execute arbitrary code under 
privileges of the user viewing image.  note the AT LEAST part of the above 
sentence.  there is such a plethora of bad code that I just stopped reading 
after a while.  there are at least 100 calls to sprintf() and strcpy() with no 
regards for bounds of buffers.  95% of these deal with program arguments or 
filenames, so they are of no interest to exploit.  however I just got sick of 
reading this code after not too long.  so im sure there are still other 
overflows in the image handling code for other image types. 
 
 
Details: 
 
xvbmp.c +168 -  a user value is used to iterate a loop and copy data to a 
stack 
                buffer. 
 
xviris.c +270 - multiple heap overflows due to integer overflows in memory 
                allocation with user supplied values. 
 
xvpcx.c +226 -  another integer overflow in memory allocation leading to a 
heap 
                overflow. 
 
xvpm.c +141 -   another integer overflow in memory allocation leading to a 
heap 
                overflow. 
Exploits: 
 
an exploit for the first overflow is attached.  I might write some more 
exploits 
for the rest when i'm bored, but atm there are more interesting things to try 
and exploit, ie Qt.  if you're really in need of more exploits, email me at my  
REAL email address and i'll make some time to try and write them. 
 
 
Credits, Thanks, and Shouts: 
 
All vulnerabilities were found by myself.  thanks to christian I don't know if 
he wants me to say his last name for suggesting I audit xv.  shouts to peeps 
at 
byterage. 
 
 
Vendor Status: 
 
this guy doesn't answer emails.