-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ NASA BigView Stack Buffer Overflow *Advisory Information* Title: NASA BigView Stack Buffer Overflow Advisory ID: CORE-2008-0425 Advisory URL: http://www.coresecurity.com/?action=item&id=2304 Date published: 2008-06-04 Date of last update: 2008-06-03 Vendors contacted: NASA Ames Research Center Release mode: Coordinated release *Vulnerability Information* Class: Stack Overflow Remotely Exploitable: Yes (client side) Locally Exploitable: No Bugtraq ID: 29517 CVE Name: CVE-2008-2542 *Vulnerability Description* NASA BigView [1] allows for interactive panning and zooming of images of arbitrary size on desktop PCs running Linux. Using this software, one can explore (on relatively modest machines) images such as the Mars Orbiter Camera mosaic [92160x33280 pixels]. The BigView package suffers from a stack buffer overflow when parsing specially crafted (invalid) PNM input files. If successful, a malicious third party could trigger execution of arbitrary code within the context of the application, or otherwise crash the whole application. The vulnerability is caused due to the BigView package not properly checking the line length of the ascii PNM input files before copying it on a stack buffer. This can be exploited to get arbitrary code execution by opening a specially crafted file. Exploitation of the PNM overflow problem requires the user to explicitly open a malicious file. The user should refrain from opening files from untrusted third parties or accessing untrusted Web sites until the patch is applied. *Vulnerable Packages* . BigView revision 1.8. . Older BigView versions could be affected too, but they were not tested. *Non-vulnerable Packages* . Available through BigView website (since June 2nd 2008, see below). *Vendor Information, Solutions and Workarounds* The NASA BigView team has published a new version fixing this vulnerability. The tarball is available on BigView's website: http://opensource.arc.nasa.gov/project/bigview/ *Credits* This vulnerability was discovered and researched by Alfredo Ortega, from CORE IMPACT's Exploit Writing Team (EWT), Core Security Technologies. *Technical Description / Proof of Concept Code* The BigView package suffers from a stack buffer overflow when parsing specially crafted (invalid) PNM input files. If successful, a malicious third party could trigger execution of arbitrary code within the context of the application, or otherwise crash the whole application. The vulnerability resides in the following code at 'Ppm/ppm.C'. Here, the function 'getline()' reads data from a file into a buffer. This is the complete function: /----------- 418 static void getline(int fin, char* lineBuf, int len) 419 { 420 bool done=false; 421 int index=0; 422 lineBuf[index]=' '; 423 while(! done){ 424 lineBuf[index] = getOneChar(fin); 425 if( lineBuf[index]==10 ) { 426 lineBuf[index]=0; 427 done=true; 428 } 429 ++index; 430 } 431 lineBuf[index]=0; 432 } - -----------/ Clearly the function requires the length of the destination buffer, but it is never used internally. This function is used on the 'PPM::ppmHeader()' function, to read the header of the PPM file. /----------- 56 PPM::ppmHeader(string filename, PPM::Format* format, 57 int* cpp, int* bpc, 58 int* sizeX, int* sizeY, 59 int* imageOffset) 60 { 61 std::ostringstream err; 62 char magic[3],lineBuf[512],junk; 63 int res,max; . . . 115 while( junk == '#' ){ 116 getline(fin,lineBuf,512); 117 cout << "Comment:"<