Gentoo Logo

kfax: Multiple overflows in the included TIFF library

Content:

1.  Gentoo Linux Security Advisory

Version Information

Advisory Reference GLSA 200412-17 / kfax
Release Date December 19, 2004
Latest Revision January 12, 2005: 04
Impact normal
Exploitable remote
Package Vulnerable versions Unaffected versions Architecture(s)
kde-base/kdegraphics < 3.3.2 >= 3.3.2 All supported architectures

Related bugreports: #73795

Synopsis

kfax contains several buffer overflows potentially leading to execution of arbitrary code.

2.  Impact Information

Background

KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. kfax (part of kdegraphics) is the KDE fax file viewer.

Description

Than Ngo discovered that kfax contains a private copy of the TIFF library and is therefore subject to several known vulnerabilities (see References).

Impact

A remote attacker could entice a user to view a carefully-crafted TIFF image file with kfax, which would potentially lead to execution of arbitrary code with the rights of the user running kfax.

3.  Resolution Information

Workaround

The KDE Team recommends to remove the kfax binary as well as the kfaxpart.la KPart:

Code Listing 3.1: Workaround

rm /usr/kde/3.*/lib/kde3/kfaxpart.la
rm /usr/kde/3.*/bin/kfax

Note: This will render the kfax functionality useless, if kfax functionality is needed you should upgrade to the KDE 3.3.2 which is not stable at the time of this writing.

There is no known workaround at this time.

Resolution

All kfax users should upgrade to the latest version:

Code Listing 3.2: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kdegraphics-3.3.2"

4.  References



Print

Page updated December 19, 2004

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.

Copyright 2001-2014 Gentoo Foundation, Inc. Questions, Comments? Contact us.