cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in OpenJDK and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted image that triggers execution of incorrect code for "transformations of monochrome profiles."

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - lcms: Null pointer dereference (DoS) by handling transformations of monochrome profiles (CVE-2009-0793)

  - lcms: Stack-based buffer overflows in ColorSpace conversion calculator and TIFF compare utility     (CVE-2013-4276)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

From Red Hat Security Advisory 2009:0377 :

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE) contains the software and tools that users need to run applications written using the Java programming language.

A flaw was found in the way that the Java Virtual Machine (JVM) handled temporary font files. A malicious applet could use this flaw to use large amounts of disk space, causing a denial of service.
(CVE-2006-2426)

A memory leak flaw was found in LittleCMS (embedded in OpenJDK). An application using color profiles could use excessive amounts of memory, and possibly crash after using all available memory, if used to open specially crafted images. (CVE-2009-0581)

Multiple integer overflow flaws which could lead to heap-based buffer overflows, as well as multiple insufficient input validation flaws, were found in the way LittleCMS handled color profiles. An attacker could use these flaws to create a specially crafted image file which could cause a Java application to crash or, possibly, execute arbitrary code when opened. (CVE-2009-0723, CVE-2009-0733)

A NULL pointer dereference flaw was found in LittleCMS. An application using color profiles could crash while converting a specially crafted image file. (CVE-2009-0793)

A flaw in the Java API for XML Web Services (JAX-WS) service endpoint handling could allow a remote attacker to cause a denial of service on the server application hosting the JAX-WS service endpoint.
(CVE-2009-1101)

A flaw in the way the Java Runtime Environment initialized LDAP connections could allow a remote, authenticated user to cause a denial of service on the LDAP service. (CVE-2009-1093)

A flaw in the Java Runtime Environment LDAP client could allow malicious data from an LDAP server to cause arbitrary code to be loaded and then run on an LDAP client. (CVE-2009-1094)

Several buffer overflow flaws were found in the Java Runtime Environment unpack200 functionality. An untrusted applet could extend its privileges, allowing it to read and write local files, as well as to execute local applications with the privileges of the user running the applet. (CVE-2009-1095, CVE-2009-1096)

A flaw in the Java Runtime Environment Virtual Machine code generation functionality could allow untrusted applets to extend their privileges. An untrusted applet could extend its privileges, allowing it to read and write local files, as well as execute local applications with the privileges of the user running the applet.
(CVE-2009-1102)

A buffer overflow flaw was found in the splash screen processing. A remote attacker could extend privileges to read and write local files, as well as to execute local applications with the privileges of the user running the java process. (CVE-2009-1097)

A buffer overflow flaw was found in how GIF images were processed. A remote attacker could extend privileges to read and write local files, as well as execute local applications with the privileges of the user running the java process. (CVE-2009-1098)

Note: The flaws concerning applets in this advisory, CVE-2009-1095, CVE-2009-1096, and CVE-2009-1102, can only be triggered in java-1.6.0-openjdk by calling the 'appletviewer' application.

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

It was discovered that a NULL pointer dereference in the code for handling transformations of monochrome profiles could allow an attacker to cause a denial of service through a specially crafted image. (CVE-2009-0793).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated java-1.6.0-openjdk packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

These packages provide the OpenJDK 6 Java Runtime Environment and the OpenJDK 6 Software Development Kit. The Java Runtime Environment (JRE) contains the software and tools that users need to run applications written using the Java programming language.

A flaw was found in the way that the Java Virtual Machine (JVM) handled temporary font files. A malicious applet could use this flaw to use large amounts of disk space, causing a denial of service.
(CVE-2006-2426)

A memory leak flaw was found in LittleCMS (embedded in OpenJDK). An application using color profiles could use excessive amounts of memory, and possibly crash after using all available memory, if used to open specially crafted images. (CVE-2009-0581)

Multiple integer overflow flaws which could lead to heap-based buffer overflows, as well as multiple insufficient input validation flaws, were found in the way LittleCMS handled color profiles. An attacker could use these flaws to create a specially crafted image file which could cause a Java application to crash or, possibly, execute arbitrary code when opened. (CVE-2009-0723, CVE-2009-0733)

A NULL pointer dereference flaw was found in LittleCMS. An application using color profiles could crash while converting a specially crafted image file. (CVE-2009-0793)

A flaw in the Java API for XML Web Services (JAX-WS) service endpoint handling could allow a remote attacker to cause a denial of service on the server application hosting the JAX-WS service endpoint.
(CVE-2009-1101)

A flaw in the way the Java Runtime Environment initialized LDAP connections could allow a remote, authenticated user to cause a denial of service on the LDAP service. (CVE-2009-1093)

A flaw in the Java Runtime Environment LDAP client could allow malicious data from an LDAP server to cause arbitrary code to be loaded and then run on an LDAP client. (CVE-2009-1094)

Several buffer overflow flaws were found in the Java Runtime Environment unpack200 functionality. An untrusted applet could extend its privileges, allowing it to read and write local files, as well as to execute local applications with the privileges of the user running the applet. (CVE-2009-1095, CVE-2009-1096)

A flaw in the Java Runtime Environment Virtual Machine code generation functionality could allow untrusted applets to extend their privileges. An untrusted applet could extend its privileges, allowing it to read and write local files, as well as execute local applications with the privileges of the user running the applet.
(CVE-2009-1102)

A buffer overflow flaw was found in the splash screen processing. A remote attacker could extend privileges to read and write local files, as well as to execute local applications with the privileges of the user running the java process. (CVE-2009-1097)

A buffer overflow flaw was found in how GIF images were processed. A remote attacker could extend privileges to read and write local files, as well as execute local applications with the privileges of the user running the java process. (CVE-2009-1098)

Note: The flaws concerning applets in this advisory, CVE-2009-1095, CVE-2009-1096, and CVE-2009-1102, can only be triggered in java-1.6.0-openjdk by calling the 'appletviewer' application.

All users of java-1.6.0-openjdk are advised to upgrade to these updated packages, which resolve these issues. All running instances of OpenJDK Java must be restarted for the update to take effect.

The XML signature checker did not impose limits on the minimum length of HMAC signatures in XML documentes. Attackers could therefore specify a length of e.g. 1 to make the signature appear valid and therefore effectively bypass verification of XML documents.
(CVE-2009-0217) The WebStart component does not allow to run unsigned code in some cases. (CVE-2009-1896) A NULL pointer dereference was fixed in the LittleCMS component. (CVE-2009-0793)

Multiple security vulnerabilities has been identified and fixed in Little cms library embedded in OpenJDK :

A memory leak flaw allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted image file (CVE-2009-0581).

Multiple integer overflows allow remote attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow (CVE-2009-0723).

Multiple stack-based buffer overflows allow remote attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel (CVE-2009-0733).

A flaw in the transformations of monochrome profiles allows remote attackers to cause denial of service triggered by a NULL pointer dereference via a crafted image file (CVE-2009-0793).

Further security fixes in the JRE and in the Java API of OpenJDK :

A flaw in handling temporary font files by the Java Virtual Machine (JVM) allows remote attackers to cause denial of service (CVE-2006-2426).

An integer overflow flaw was found in Pulse-Java when handling Pulse audio source data lines. An attacker could use this flaw to cause an applet to crash, leading to a denial of service (CVE-2009-0794).

A flaw in Java Runtime Environment initialized LDAP connections allows authenticated remote users to cause denial of service on the LDAP service (CVE-2009-1093).

A flaw in the Java Runtime Environment LDAP client in handling server LDAP responses allows remote attackers to execute arbitrary code on the client side via malicious server response (CVE-2009-1094).

Buffer overflows in the the Java Runtime Environment unpack200 utility allow remote attackers to execute arbitrary code via an crafted applet (CVE-2009-1095, CVE-2009-1096).

A buffer overflow in the splash screen processing allows a attackers to execute arbitrary code (CVE-2009-1097).

A buffer overflow in GIF images handling allows remote attackers to execute arbitrary code via an crafted GIF image (CVE-2009-1098).

A flaw in the Java API for XML Web Services (JAX-WS) service endpoint handling allows remote attackers to cause a denial of service on the service endpoint's server side (CVE-2009-1101).

A flaw in the Java Runtime Environment Virtual Machine code generation allows remote attackers to execute arbitrary code via a crafted applet (CVE-2009-1102).

This update provides fixes for these issues.

Update :

java-1.6.0-openjdk requires rhino packages and these has been further updated.

Multiple security vulnerabilities has been identified and fixed in Little cms :

A memory leak flaw allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted image file (CVE-2009-0581).

Multiple integer overflows allow remote attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow (CVE-2009-0723).

Multiple stack-based buffer overflows allow remote attackers to execute arbitrary code via a crafted image file associated with a large integer value for the (1) input or (2) output channel (CVE-2009-0733).

A flaw in the transformations of monochrome profiles allows remote attackers to cause denial of service triggered by a NULL pointer dereference via a crafted image file (CVE-2009-0793).

This update provides fixes for these issues.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

CVE-2009-0793 The patch was given by lcms upstream on the lcms announce mailing list.
http://sourceforge.net/mailarchive/message.php?msg_name=49EB3510.90607 03% 40littlecms.com

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixes remaining LCMS issue, which resolves a TCK failure

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200904-19 (LittleCMS: Multiple vulnerabilities)

    RedHat reported a NULL pointer dereference flaw while processing     monochrome ICC profiles (CVE-2009-0793).
    Chris Evans of Google discovered the following vulnerabilities:
    LittleCMS contains severe memory leaks (CVE-2009-0581).
    LittleCMS is prone to multiple integer overflows, leading to a     heap-based buffer overflow (CVE-2009-0723).
    The     ReadSetOfCurves() function is vulnerable to stack-based buffer     overflows when called from code paths without a bounds check on channel     counts (CVE-2009-0733).
  Impact :

    A remote attacker could entice a user or automated system to open a     specially crafted file containing a malicious ICC profile, possibly     resulting in the execution of arbitrary code with the privileges of the     user running the application or memory exhaustion, leading to a Denial     of Service condition.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been identified in OpenJDK, an implementation of the Java SE platform.

  - CVE-2006-2426     Creation of large, temporary fonts could use up     available disk space, leading to a denial of service     condition.

  - CVE-2009-0581 / CVE-2009-0723 / CVE-2009-0733 /     CVE-2009-0793

    Several vulnerabilities existed in the embedded     LittleCMS library, exploitable through crafted images: a     memory leak, resulting in a denial of service condition     (CVE-2009-0581 ), heap-based buffer overflows,     potentially allowing arbitrary code execution     (CVE-2009-0723, CVE-2009-0733 ), and a NULL pointer     dereference, leading to denial of service (CVE-2009-0793     ).

  - CVE-2009-1093     The LDAP server implementation (in com.sun.jdni.ldap)     did not properly close sockets if an error was     encountered, leading to a denial-of-service condition.

  - CVE-2009-1094     The LDAP client implementation (in com.sun.jdni.ldap)     allowed malicious LDAP servers to execute arbitrary code     on the client.

  - CVE-2009-1101     The HTTP server implementation (sun.net.httpserver)     contained an unspecified denial of service     vulnerability.

  - CVE-2009-1095 / CVE-2009-1096 / CVE-2009-1097 /     CVE-2009-1098

    Several issues in Java Web Start have been addressed.
    The Debian packages currently do not support Java Web     Start, so these issues are not directly exploitable, but     the relevant code has been updated nevertheless.

ID	Name	Product	Family	Severity
198677	RHEL 5 : lcms (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
67831	Oracle Linux 5 : java-1.6.0-openjdk (ELSA-2009-0377)	Nessus	Oracle Linux Local Security Checks	critical
51509	Ubuntu 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : lcms vulnerability (USN-1043-1)	Nessus	Ubuntu Local Security Checks	medium
43736	CentOS 5 : java-1.6.0-openjdk (CESA-2009:0377)	Nessus	CentOS Local Security Checks	critical
40818	openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-1252)	Nessus	SuSE Local Security Checks	critical
40816	openSUSE Security Update : java-1_6_0-openjdk (java-1_6_0-openjdk-1252)	Nessus	SuSE Local Security Checks	critical
39478	Mandriva Linux Security Advisory : java-1.6.0-openjdk (MDVSA-2009:137)	Nessus	Mandriva Local Security Checks	critical
38865	Mandriva Linux Security Advisory : lcms (MDVSA-2009:121-1)	Nessus	Mandriva Local Security Checks	high
38727	Fedora 10 : lcms-1.18-2.fc10 (2009-3967)	Nessus	Fedora Local Security Checks	medium
38726	Fedora 9 : lcms-1.18-2.fc9 (2009-3914)	Nessus	Fedora Local Security Checks	medium
37517	Fedora 10 : java-1.6.0-openjdk-1.6.0.0-15.b14.fc10 (2009-3426)	Nessus	Fedora Local Security Checks	medium
36198	GLSA-200904-19 : LittleCMS: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
36142	Debian DSA-1769-1 : openjdk-6 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
36111	RHEL 5 : java-1.6.0-openjdk (RHSA-2009:0377)	Nessus	Red Hat Local Security Checks	critical
36110	Fedora 9 : java-1.6.0-openjdk-1.6.0.0-0.25.b09.fc9 (2009-3425)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2009-0793

high

Tenable Plugins

high

critical

medium

critical

critical

critical

critical

high

medium

medium

medium

high

critical

critical

medium