Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.Sign up
Integer overflow in _cupsImageReadTIFF() #3031
As reported by iDefense:
Remote exploitation of an integer overflow vulnerability in CUPS, as included in various vendors' operating system distributions, could allow an attacker to execute arbitrary code with the privileges of the affected service.
The Common Unix Printing System, more commonly referred to as CUPS, provides a standard printer interface for various Unix-based operating systems. "imagetops" is a part of CUPS responsible for creating PostScript representations of different graphic file formats.
When parsing TIFF files, the _cupsImageReadTIFF() function does not properly validate the image 'height' taken from the file. This value is then used in an arithmetic operation that calculates the size of a dynamic heap buffer. By providing a large value for the image height, this calculation can overflow, which then leads to a heap based buffer overflow.
Exploiting heap overflow vulnerabilities on modern Unix systems can be difficult due to various heap protection schemes. The attacker, however, has very fine-grained control over the overflow, which somewhat eases the difficulty of exploitation.
To exploit this vulnerability remotely, the targeted host must be sharing one or more printers on the network. If a printer is not being shared, CUPS only listens on the localhost interface, and the scope of this vulnerability would be limited to local privilege escalation.
--- filter/image-private.h (revision 8153)
define CUPS_IMAGE_MAX_WIDTH 0x07ffffff
-# define CUPS_IMAGE_MAX_HEIGHT 0x7fffffff