libjpeg-mmx: CVE-2006-3005: memory exhaustion

Debian Bug report logs - #373672
libjpeg-mmx: CVE-2006-3005: memory exhaustion

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Alec Berryman <alec@thened.net>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libjpeg-mmx: CVE-2006-3005: memory exhaustion

Date: Wed, 14 Jun 2006 17:53:45 -0500

[Message part 1 (text/plain, inline)]

Package: libjpeg-mmx
Severity: important
Tags: security patch

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2006-3005: "The JPEG library in media-libs/jpeg before 6b-r7 on
Gentoo Linux is built without the -maxmem feature, which could allow
context-dependent attackers to cause a denial of service (memory
exhaustion) via a crafted JPEG file that exceeds the intended memory
limits."

Although the CVE is Gentoo-specific, Debian's libjpeg-mmx is not built
with --maxmem enabled, making it vulnerable.  I have attached a trivial
patch to enable --maxmem to the same limit used in libjpeg62.  The
Gentoo bug report mentioned in the CVE [1] contains a more elaborate
patch [2] that limits the maximum amount of allocatable memory to 95% of
physical memory.  I believe the second patch is the better solution -
libjpeg62 sets maxmem to 1024MB, and that doesn't help much when mem +
swap is less than 1024 (the sample exploit image attached to the Gentoo
bug starts my computer thrashing).

Neither the Woody nor the Sarge version build with --maxmem and are
vulnerable.

Please mention the CVE in your changelog.

Thanks,

Alec

[1] http://bugs.gentoo.org/show_bug.cgi?id=130889
[2] http://bugs.gentoo.org/attachment.cgi?id=88029&action=view

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEkJN3Aud/2YgchcQRAv7UAKCL3GLZjODa6PbqNNlJe6Wdq0XMxQCfb3j7
Ykn3VKh6AClF8pIAaSBn8/Q=
=Dx7A
-----END PGP SIGNATURE-----

[CVE-2006-3005.diff (text/plain, attachment)]

Message #10 received at 373672@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Alec Berryman <alec@thened.net>, 373672@bugs.debian.org

Cc: team@security.debian.org

Subject: Re: Bug#373672: libjpeg-mmx: CVE-2006-3005: memory exhaustion

Date: Thu, 15 Jun 2006 12:10:15 +0200

On Wed, Jun 14, 2006 at 05:53:45PM -0500, Alec Berryman wrote:
> Package: libjpeg-mmx
> Severity: important
> Tags: security patch
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> CVE-2006-3005: "The JPEG library in media-libs/jpeg before 6b-r7 on
> Gentoo Linux is built without the -maxmem feature, which could allow
> context-dependent attackers to cause a denial of service (memory
> exhaustion) via a crafted JPEG file that exceeds the intended memory
> limits."
> 
> Although the CVE is Gentoo-specific, Debian's libjpeg-mmx is not built
> with --maxmem enabled, making it vulnerable.  I have attached a trivial
> patch to enable --maxmem to the same limit used in libjpeg62.  The
> Gentoo bug report mentioned in the CVE [1] contains a more elaborate
> patch [2] that limits the maximum amount of allocatable memory to 95% of
> physical memory.  I believe the second patch is the better solution -
> libjpeg62 sets maxmem to 1024MB, and that doesn't help much when mem +
> swap is less than 1024 (the sample exploit image attached to the Gentoo
> bug starts my computer thrashing).
> 
> Neither the Woody nor the Sarge version build with --maxmem and are
> vulnerable.

I don't see the point. There are valid use cases, where very large files
are required and if an admin encounters problems with users handling
overly large pictures she can apply site-specific resource limits.

Cheers,
        Moritz

Message #15 received at 373672@bugs.debian.org (full text, mbox, reply):

From: Alec Berryman <alec@thened.net>

To: Moritz Muehlenhoff <jmm@inutil.org>

Cc: 373672@bugs.debian.org, team@security.debian.org

Subject: Re: Bug#373672: libjpeg-mmx: CVE-2006-3005: memory exhaustion

Date: Fri, 16 Jun 2006 12:51:41 -0400

[Message part 1 (text/plain, inline)]

Moritz Muehlenhoff on 2006-06-15 12:10:15 +0200:

> On Wed, Jun 14, 2006 at 05:53:45PM -0500, Alec Berryman wrote:
> 
> > Although the CVE is Gentoo-specific, Debian's libjpeg-mmx is not built
> > with --maxmem enabled, making it vulnerable.  I have attached a trivial
> > patch to enable --maxmem to the same limit used in libjpeg62.  The
> > Gentoo bug report mentioned in the CVE [1] contains a more elaborate
> > patch [2] that limits the maximum amount of allocatable memory to 95% of
> > physical memory.  I believe the second patch is the better solution -
> > libjpeg62 sets maxmem to 1024MB, and that doesn't help much when mem +
> > swap is less than 1024 (the sample exploit image attached to the Gentoo
> > bug starts my computer thrashing).
> 
> I don't see the point. There are valid use cases, where very large files
> are required and if an admin encounters problems with users handling
> overly large pictures she can apply site-specific resource limits.

The sample exploit JPEG [1] is under 1kb; that's easily small enough to
smuggle into a web page or upload to an unsuspecting image processor.

That being said, while the exploit worked for me yesterday, it doesn't
for me today.  I'm not sure what changed (or if I just screwed up the
first time); if no one can confirm this, it ought to be closed..

[1] http://bugs.gentoo.org/attachment.cgi?id=85214

[Message part 2 (application/pgp-signature, inline)]

Message #20 received at 373672-done@bugs.debian.org (full text, mbox, reply):

From: Matej Vela <vela@debian.org>

To: 129411-done@bugs.debian.org, 195050-done@bugs.debian.org, 323354-done@bugs.debian.org, 367949-done@bugs.debian.org, 373672-done@bugs.debian.org, 379497-done@bugs.debian.org

Subject: Removed

Date: Tue, 15 Aug 2006 20:51:28 +0200

libjpeg-mmx has been removed from Debian due to serious bugs and
upstream inactivity.  For details, see <http://bugs.debian.org/382584>.

Send a report that this bug log contains spam.