Buffer overflow in the EXIF library (libexif) 0.6.9 does not properly validate the structure of the EXIF tags, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a JPEG image with a crafted EXIF tag.

GNOME 2.6.0_x86: GNOME EXIF tag parsing library for digital camera.
Date this patch was last updated by Sun : Feb/11/16

GNOME 2.6.0_x86: GNOME EXIF tag parsing library for digital camera.
Date this patch was last updated by Sun : Jul/11/13

GNOME 2.6.0: GNOME EXIF tag parsing library for digital cameras.
Date this patch was last updated by Sun : Feb/11/16

GNOME 2.6.0: GNOME EXIF tag parsing library for digital cameras.
Date this patch was last updated by Sun : Jul/11/13

GNOME 2.6.0_x86: libexif Patch.
Date this patch was last updated by Sun : Nov/15/05

Sylvain Defresne reports that libexif is vulnerable to a buffer overflow vulnerability due to insufficient input checking. This could lead crash of applications using libexif.

Sylvain Defresne discovered a buffer overflow in libexif, a library that parses EXIF files (such as JPEG files with extra tags). This bug could be exploited to crash the application and maybe to execute arbitrary code as well.

A buffer overflow was discovered in the way libexif parses EXIF tags.
An attacker could exploit this by creating a special EXIF image file which could cause image viewers linked against libexif to crash.

The updated packages have been patched to correct these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:300 advisory.

    The libexif package contains the EXIF library. Applications use this     library to parse EXIF image files.

    A bug was found in the way libexif parses EXIF tags. An attacker could     create a carefully crafted EXIF image file which could cause image viewers     linked against libexif to crash. The Common Vulnerabilities and Exposures     project (cve.mitre.org) has assigned the name CAN-2005-0664 to this issue.

    Users of libexif should upgrade to these updated packages, which contain a     backported patch and are not vulnerable to this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200503-17 (libexif: Buffer overflow vulnerability)

    libexif contains a buffer overflow vulnerability in the EXIF tag     validation code. When opening an image with a specially crafted EXIF     tag, the lack of validation can cause applications linked to libexif to     crash.
  Impact :

    A specially crafted EXIF file could crash applications making use     of libexif, potentially allowing the execution of arbitrary code with     the privileges of the user running the application.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
107874	Solaris 10 (x86) : 121096-05	Nessus	Solaris Local Security Checks	medium
107873	Solaris 10 (x86) : 121096-04	Nessus	Solaris Local Security Checks	medium
107372	Solaris 10 (sparc) : 121095-05	Nessus	Solaris Local Security Checks	medium
107371	Solaris 10 (sparc) : 121095-04	Nessus	Solaris Local Security Checks	medium
23620	Solaris 9 (x86) : 121093-01	Nessus	Solaris Local Security Checks	low
18957	FreeBSD : libexif -- buffer overflow vulnerability (624fe633-9006-11d9-a22c-0001020eed82)	Nessus	FreeBSD Local Security Checks	low
18056	Debian DSA-709-1 : libexif - buffer overflow	Nessus	Debian Local Security Checks	low
17670	Mandrake Linux Security Advisory : libexif (MDKSA-2005:064)	Nessus	Mandriva Local Security Checks	low
17591	RHEL 4 : libexif (RHSA-2005:300)	Nessus	Red Hat Local Security Checks	high
17319	GLSA-200503-17 : libexif: Buffer overflow vulnerability	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2005-0664

high

Tenable Plugins

medium

medium

medium

medium

low

low

low

low

high

low