Quantum Secular Labs / Blog / Advisories

CVE-2004-0597: Greg Roelofs Libpng: Buffer overflow

CVE-2004-0597 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Greg Roelofs Libpng, along with 5 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access vector: Network. Exploitable remotely over the network.
  • Access complexity: Low. No special conditions are required.
  • Authentication: None. No authentication is needed.
  • Confidentiality impact: Complete. Total information disclosure.
  • Integrity impact: Complete. Total loss of integrity.
  • Availability impact: Complete. Total shutdown of the component.

Affected products

  • Greg Roelofs Libpng: up to and including 1.2.5
  • Microsoft Msn Messenger: 6.1; 6.2
  • Microsoft Windows Media Player: 9
  • Microsoft Windows Messenger: 5.0
  • Microsoft Windows 98se: all versions listed by NVD
  • Microsoft Windows Me: all versions listed by NVD

References