bugtraq - pdflib long filename multiple bufferoverflows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <F7920D78-B17E-4D0D-8439-3EFF51701724@papuasia.org>
Date: Sun, 23 Dec 2007 00:01:03 +0100
From: poplix <poplix@...uasia.org>
To: bugtraq@...urityfocus.com
Subject: pdflib long filename multiple bufferoverflows

hi,
pdflib, a library for generating PDF on the fly, avilable at http:// 
www.pdflib.com, is vulnerable to multiple bufferoverflows due to a  
misuse of strcpy().
An attacker can exploit this issue to execute arbitrary code or to  
crash the application that uses the library.
One of the vulnerable functions is pdc_fsearch_fopen() that is  
called, for example, by PDF_load_image() which overflows a stack  
buffer if a long filename is provided.
The php wrapper for pdflib (pecl extension) is also vulnerable so  
please take care of allowing users to generate custom pdfs from webapps.

this is a proof-of-concept that crashes php:
<?php
.....
PDF_load_image($p,"jpeg",str_repeat("A",1100), null);

?>

The developers have been warned and they plained to fix those bugs in  
the next release.

cheers,
-poplix
http://px.dynalias.org