CVE-2008-1382— Libpng库未知类型块处理远程代码执行漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

n/a n/a

利用判断

利用概率较高，应尽快评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

libpng是多种应用程序所使用的解析PNG图形格式的函数库 。 libpng库在处理畸形格式的PNG文件时存在漏洞，成功利用此漏洞允许本地攻击者读取敏感信息、导致拒绝服务或执行任意指令 。 libpng库没有正确地处理未知类型的PNG块，如果使用该库的应用程序在特定情况下调用了png_set_read_user_chunk_fn()或png_set_keep_unknown_chunks()函数的话，长度为0的PNG块就会导致通过free()调用使用未初始化的内存 。

CVE-2008-1382 影响 n/a n/a。利用概率较高，应尽快评估。libpng是多种应用程序所使用的解析PNG图形格式的函数库 。 libpng库在处理畸形格式的PNG文件时存在漏洞，成功利用此漏洞允许本地攻击者读取敏感信息、导致拒绝服务或执行任意指令 。 libpng库没有正确地处理未知类型的PNG块，如果使用该库的应用程序在特定情况下调用了png_set_read_user_chunk_fn()或png_set_kee CVE-2008-1382 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2008-1382

一、 漏洞 CVE-2008-1382 基础信息

受影响产品

二、漏洞 CVE-2008-1382 的公开POC

三、漏洞 CVE-2008-1382 的情报信息

CVE-2008-1382 厂商安全公告 (41)

• http://www.vmware.com/security/advisories/VMSA-2009-0007.html x_refsource_CONFIRM
• http://support.apple.com/kb/HT3549 x_refsource_CONFIRM
• http://secunia.com/advisories/30157 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/30402 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/35258 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/30174 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/34152 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/30009 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/29992 third-party-advisory x_refsource_SECUNIA
• http://www.securityfocus.com/bid/28770 vdb-entry x_refsource_BID
• http://secunia.com/advisories/35074 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/30486 third-party-advisory x_refsource_SECUNIA
• http://www.osvdb.org/44364 vdb-entry x_refsource_OSVDB
• http://secunia.com/advisories/35302 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/29957 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/35386 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/31882 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/34388 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/33137 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/29792 third-party-advisory x_refsource_SECUNIA
• http://secunia.com/advisories/29678 third-party-advisory x_refsource_SECUNIA
• http://www.securitytracker.com/id?1019840 vdb-entry x_refsource_SECTRACK
• http://www.debian.org/security/2009/dsa-1750 vendor-advisory x_refsource_DEBIAN
• http://www.us-cert.gov/cas/techalerts/TA09-133A.html third-party-advisory x_refsource_CERT
• http://www.us-cert.gov/cas/techalerts/TA08-260A.html third-party-advisory x_refsource_CERT
• http://www.vupen.com/english/advisories/2009/1462 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2008/2584 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2009/1451 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2008/1225/references vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2009/1560 vdb-entry x_refsource_VUPEN
• http://www.vupen.com/english/advisories/2009/1297 vdb-entry x_refsource_VUPEN
• http://security.gentoo.org/glsa/glsa-200812-15.xml vendor-advisory x_refsource_GENTOO
• http://security.gentoo.org/glsa/glsa-200804-15.xml vendor-advisory x_refsource_GENTOO
• http://www.mandriva.com/security/advisories?name=MDVSA-2008:156 vendor-advisory x_refsource_MANDRIVA
• http://security.gentoo.org/glsa/glsa-200805-10.xml vendor-advisory x_refsource_GENTOO
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6275 vdb-entry signature x_refsource_OVAL
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10326 vdb-entry signature x_refsource_OVAL
• http://www.securityfocus.com/archive/1/491424/100/0/threaded mailing-list x_refsource_BUGTRAQ
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41800 vdb-entry x_refsource_XF
• http://www.securityfocus.com/archive/1/490823/100/0/threaded mailing-list x_refsource_BUGTRAQ
• http://www.securityfocus.com/archive/1/503912/100/0/threaded mailing-list x_refsource_BUGTRAQ

CVE-2008-1382 邮件列表归档 (3)

• 🔗 [security-announce] SUSE Security Summary Report SUSE-SR:2008:010 - openSUSE Security Announce - openSUSE Mailing Lists 查看完整文章 vendor-advisory x_refsource_SUSE
• http://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html vendor-advisory x_refsource_APPLE
• http://lists.apple.com/archives/security-announce/2009/May/msg00002.html vendor-advisory x_refsource_APPLE

CVE-2008-1382 其他参考 (14)

• http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0151 x_refsource_CONFIRM
• http://support.avaya.com/elmodocs2/security/ASA-2009-208.htm x_refsource_CONFIRM
• http://libpng.sourceforge.net/Advisory-1.2.26.txt x_refsource_CONFIRM
• http://www.ocert.org/advisories/ocert-2008-003.html x_refsource_MISC
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-259989-1 vendor-advisory x_refsource_SUNALERT
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020521.1-1 vendor-advisory x_refsource_SUNALERT
• http://www.redhat.com/support/errata/RHSA-2009-0333.html vendor-advisory x_refsource_REDHAT
• http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.541247 vendor-advisory x_refsource_SLACKWARE
• https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00111.html vendor-advisory x_refsource_FEDORA
• https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00960.html vendor-advisory x_refsource_FEDORA
• https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00080.html vendor-advisory x_refsource_FEDORA
• https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00721.html vendor-advisory x_refsource_FEDORA
• https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00033.html vendor-advisory x_refsource_FEDORA
• https://www.redhat.com/archives/fedora-package-announce/2008-May/msg00951.html vendor-advisory x_refsource_FEDORA

• https://www.cve.org/CVERecord?id=CVE-2008-1382

同批安全公告 · n/a · 2008-04-14 · 共 15 条

IV. Related Vulnerabilities

V. Comments for CVE-2008-1382