GLSA 200412-17: kfax: Multiple overflows in the included TIFF library

http://security.gentoo.org/

Severity:	normal
Title:	kfax: Multiple overflows in the included TIFF library
Date:	12/19/2004
Bugs:	#73795
ID:	200412-17

Synopsis

kfax contains several buffer overflows potentially leading to execution of arbitrary code.

Background

KDE is a feature-rich graphical desktop environment for Linux and Unix-like Operating Systems. kfax (part of kdegraphics) is the KDE fax file viewer.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
kde-base/kdegraphics	< 3.3.2	>= 3.3.2	All supported architectures

Description

Than Ngo discovered that kfax contains a private copy of the TIFF library and is therefore subject to several known vulnerabilities (see References).

Impact

A remote attacker could entice a user to view a carefully-crafted TIFF image file with kfax, which would potentially lead to execution of arbitrary code with the rights of the user running kfax.

Workaround

The KDE Team recommends to remove the kfax binary as well as the kfaxpart.la KPart:

    rm /usr/kde/3.*/lib/kde3/kfaxpart.la
    rm /usr/kde/3.*/bin/kfax

Note: This will render the kfax functionality useless, if kfax functionality is needed you should upgrade to the KDE 3.3.2 which is not stable at the time of this writing.

There is no known workaround at this time.

Resolution

All kfax users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=kde-base/kdegraphics-3.3.2"

References

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200412-17.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.