Buffer overflow in the readImageData function in giftopnm.c in netpbm before 10.27 in netpbm before 10.27 allows remote user-assisted attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted GIF image, a similar issue to CVE-2006-4484.

From Red Hat Security Advisory 2008:0131 :

Updated netpbm packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The netpbm package contains a library of functions for editing and converting between various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps) and others. The package includes no interactive tools and is primarily used by other programs (eg CGI scripts that manage website images).

An input validation flaw was discovered in the GIF-to-PNM converter (giftopnm) shipped with the netpbm package. An attacker could create a carefully crafted GIF file which could cause giftopnm to crash or possibly execute arbitrary code as the user running giftopnm.
(CVE-2008-0554)

All users are advised to upgrade to these updated packages which contain a backported patch which resolves this issue.

An input validation flaw was discovered in the GIF-to-PNM converter (giftopnm) shipped with the netpbm package. An attacker could create a carefully crafted GIF file which could cause giftopnm to crash or possibly execute arbitrary code as the user running giftopnm.
(CVE-2008-0554)

Specially crafted GIF images could cause a buffer overflow and crash netpbm. It seems unlikely but not entirely impossible that this overflow can be exploited to execute arbitrary code. (CVE-2008-0554)

It was discovered that Netpbm could be made to overrun a buffer when loading certain images. If a user were tricked into opening a specially crafted GIF image, remote attackers could cause a denial of service or execute arbitrary code with user privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was discovered in the GIF reader implementation in netpbm-free, a suite of image manipulation utilities. Insufficient input data validation could allow a maliciously-crafted GIF file to overrun a stack buffer, potentially permitting the execution of arbitrary code.

Updated netpbm packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, 3, and 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The netpbm package contains a library of functions for editing and converting between various graphics file formats, including .pbm (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps), .ppm (portable pixmaps) and others. The package includes no interactive tools and is primarily used by other programs (eg CGI scripts that manage website images).

An input validation flaw was discovered in the GIF-to-PNM converter (giftopnm) shipped with the netpbm package. An attacker could create a carefully crafted GIF file which could cause giftopnm to crash or possibly execute arbitrary code as the user running giftopnm.
(CVE-2008-0554)

All users are advised to upgrade to these updated packages which contain a backported patch which resolves this issue.

ID	Name	Product	Family	Severity
67652	Oracle Linux 3 / 4 : netpbm (ELSA-2008-0131)	Nessus	Oracle Linux Local Security Checks	medium
60368	Scientific Linux Security Update : netpbm on SL3.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41194	SuSE9 Security Update : netpbm (YOU Patch Number 12068)	Nessus	SuSE Local Security Checks	medium
38074	Ubuntu 6.06 LTS / 7.10 : netpbm-free vulnerability (USN-665-1)	Nessus	Ubuntu Local Security Checks	medium
32380	Debian DSA-1579-1 : netpbm-free - insufficient input sanitizing	Nessus	Debian Local Security Checks	medium
31305	RHEL 2.1 / 3 / 4 : netpbm (RHSA-2008:0131)	Nessus	Red Hat Local Security Checks	medium
31301	CentOS 3 / 4 : netpbm (CESA-2008:0131)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2008-0554

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium