CVE-2004-0597
published 2004-11-23CVE-2004-0597: Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images…
PriorityP262critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
81.86%
99.7th percentile
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| greg_roelofs | libpng | <= 1.2.5 | — |
| microsoft | msn_messenger | — | — |
| microsoft | msn_messenger | — | — |
| microsoft | windows_media_player | — | — |
| microsoft | windows_messenger | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
89 50 4E 47 0D 0A 1A 0A
bytes↗
00 00 00 0D 49 48 44 52 00 00 00 5B 00 00 00 45 08 03 00 00 01 65 33 5A D6
bytes↗
00 00 00 00 74 52 4E 53
bytes↗
89 50 4E 47 0D 0A 1A 0A 00 00 00 0D 49 48 44 52 00 00 00 40 00 00 00 40 08 03 00 00 00 9D B7 81 EC 00 00 01 B9 74 52 4E 53
- →Malformed PNG tRNS chunk with oversized or invalid length field targeting png_handle_tRNS; look for tRNS chunk data length inconsistent with color type (e.g., color type 0x03/palette without a preceding PLTE chunk) ↗
- →Malformed PNG with oversized sBIT or hIST chunk data triggering bounds-check bypass in png_handle_sBIT or png_handle_hIST ↗
- →For MSN Messenger exploitation vector, malicious PNG delivered via user display pictures, custom inline icons, image transfer thumbnails, or background images should be inspected ↗
- ·Exploit targets libpng 1.2.5 and earlier; versions beyond 1.2.5 contain the patch. Confirm library version before applying detection logic. ↗
- ·The libpng PoC exploit output is not a complete valid PNG — it contains only enough structure to trigger the bug; scanners expecting well-formed PNGs may miss it ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-pjf2-ggxp-rg8p: Multiple buffer overflows in libpng 1
ghsa_unreviewed·2022-05-03
CVE-2004-0597 [HIGH] GHSA-pjf2-ggxp-rg8p: Multiple buffer overflows in libpng 1
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Red Hat
security flaw
vendor_redhat·2004-08-04·CVSS 10.0
CVE-2004-0597 [CRITICAL] security flaw
security flaw
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
No detection rules found.
Exploit-DB
Microsoft MSN Messenger 6.2.0137 - '.png' Remote Buffer Overflow
exploitdb·2005-02-08
CVE-2004-0597 Microsoft MSN Messenger 6.2.0137 - '.png' Remote Buffer Overflow
Microsoft MSN Messenger 6.2.0137 - '.png' Remote Buffer Overflow
---
// source: https://www.securityfocus.com/bid/12506/info
A remotely exploitable buffer overflow exists in MSN Messenger and Windows Messenger. This vulnerability is related to parsing of Portable Network Graphics (PNG) image header data. Successful exploitation will result in execution of arbitrary code in the context of the vulnerable client user.
Attack vectors and mitigations may differ for MSN Messenger and Windows Messenger. For Windows Messenger, the attacker must spoof the .NET Messenger service and the client must be configured to receive .NET alerts.
However, MSN Messenger may be exploited through various methods in a client-to-client attack. Possible attack vectors for this vulnerability in MSN Messenger inc
Exploit-DB
LibPNG 1.2.5 - 'png_jmpbuf()' Local Buffer Overflow
exploitdb·2004-08-13
CVE-2004-0597 LibPNG 1.2.5 - 'png_jmpbuf()' Local Buffer Overflow
LibPNG 1.2.5 - 'png_jmpbuf()' Local Buffer Overflow
---
#include
#include
#include "png.h"
/* The png_jmpbuf() macro, used in error handling, became available in
* libpng version 1.0.6. If you want to be able to run your code with older
* versions of libpng, you must define the macro yourself (but only if it
* is not already defined by libpng!).
*/
#ifndef png_jmpbuf
#define png_jmpbuf(png_ptr) ((png_ptr)->jmpbuf)
#endif
#define ERROR 1
#define OK 0
int read_png(char *file_name) /* We need to open the file */
{
png_structp png_ptr;
png_infop info_ptr;
unsigned int sig_read = 0;
png_uint_32 width, height;
int bit_depth, color_type, interlace_type;
FILE *fp;
if ((fp = fopen(file_name, "rb")) == NULL)
return (ERROR);
/* Create and initialize the png_struct with the desired error handle
Exploit-DB
LibPNG Graphics Library - Remote Buffer Overflow
exploitdb·2004-08-11
CVE-2004-0597 LibPNG Graphics Library - Remote Buffer Overflow
LibPNG Graphics Library - Remote Buffer Overflow
---
/*
* exploit for libpng, tested on version 1.2.5
* infamous42md AT hotpop DOT com
*
* shouts to mitakeet (hope u patched :D)
*
* [n00b_at_localho.outernet] ./po
* Usage: ./po [ outfile ]
*
* -all u need to give is retaddr, the default file it creates is controlled by
* the define below, or u can pass a diff outfile name on the command line.
* the output is not an entire png, just enough to trigger the bug. i've also
* included a simple program to test with.
*
* [n00b_at_localho.outernet] netstat -ant | grep 7000
* [n00b_at_localho.outernet] gcc pnouch.c -Wall -o po
* [n00b_at_localho.outernet] gcc pngslap.c -o slapped -lz -lm lib/libpng12.so
* [n00b_at_localho.outernet] ./po 0xbffff8b0
* [n00b_at_localho.outernet] ./slapped britnay_spa
arXiv
Bypassing memory safety mechanisms through speculative control flow hijacks
arxiv_fulltext·2021-04-19
Bypassing memory safety mechanisms through speculative control flow hijacks
Bypassing memory safety mechanisms through speculative control flow hijacks
[1,2]Andrea Mambretti
[1]Alexandra Sandulescu
[1]Alessandro Sorniotti
[2]\ Robertson
[2]Engin Kirda
[1]Anil Kurmus
[1]IBM Research -- Zurich, R\"uschlikon, Switzerland
[ ] \asa, aso, kur\@zurich.ibm.com
[2]Northeastern University, Boston, USA
[ ] \mbr, wkr, ek\@ccs.neu.edu
empty
## Abstract
The prevalence of memory corruption bugs in the past decades resulted in
numerous defenses, such as stack canaries, control flow integrity (CFI), and
memory-safe languages. These defenses can prevent entire classes of
vulnerabilities, and help increase the security posture of a program. In this
paper, we show that memory corruption defenses can be bypassed using speculative
execution attacks. We study the cases of stack prot
arXiv
EvilCoder: Automated Bug Insertion
arxiv_fulltext·2020-07-05
EvilCoder: Automated Bug Insertion
2016
acmcopyright
ACSAC '16,December 05-09, 2016, Los Angeles, CA, USA
978-1-4503-4771-6/16/12\15.00
http://dx.doi.org/10.1145/2991079.2991103
EvilCoder: Automated Bug Insertion
2
Jannik Pewny
Horst G\"ortz Institut (HGI)
Ruhr-Universit\"at
Bochum, Germany
[email protected]
Thorsten Holz
Horst G\"ortz Institut (HGI)
Ruhr-Universit\"at
Bochum, Germany
[email protected]
June 1st, 2016
## Abstract
The art of finding software vulnerabilities has been covered extensively
in the literature and there is a huge body of work on this topic. In contrast, the
intentional insertion of exploitable, security-critical bugs
has received little (public) attention yet.
Wanting more bugs seems to be
counterproductive at first sight, but the comprehensive evaluation of bug-finding
technique
Bugzilla
CVE-2004-0597 security flaw
bugzilla·2018-08-16·CVSS 10.0
CVE-2004-0597 [CRITICAL] CVE-2004-0597 security flaw
CVE-2004-0597 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Multiple buffer overflows in libpng 1.2.5 and earlier, as used in multiple products, allow remote attackers to execute arbitrary code via malformed PNG images in which (1) the png_handle_tRNS function does not properly validate the length of transparency chunk (tRNS) data, or the (2) png_handle_sBIT or (3) png_handle_hIST functions do not perform sufficient bounds checking.
Bugzilla
CAN-2004-0597/98/99 multiple problems in libpng 1.2.5
bugzilla·2004-07-14
[MEDIUM] CAN-2004-0597/98/99 multiple problems in libpng 1.2.5
CAN-2004-0597/98/99 multiple problems in libpng 1.2.5
libpng version up to and including 1.2.5 have a couple of secuirty holes.
Here are some CVE names
> 1) Remotely exploitable stack-based buffer overrun in
png_handle_tRNS
> (pngrutil.c)
> 2) Dangerous code in png_handle_sBIT (pngrutil.c) (Similar code in
> png_handle_hIST).
CAN-2004-0597 for these (we merge issues that have the same flaw type that
get fixed in the same versions).
> 3) Possible NULL-pointer crash in png_handle_iCCP (pngrutil.c) (this
> flaw is duplicated in multiple other locations).
CAN-2004-0598 for those
> 4) Theoretical integer overflow in allocation in png_handle_sPLT
> (pngrutil.c)
> 5) Integer overflow in png_read_png (pngread.c)
> 6) Integer overflows during progressive reading.
> 7) Other flaws. [
Bugzilla
CAN-2004-0597/98/99 multiple problems in libpng 1.2.5
bugzilla·2004-07-14
[MEDIUM] CAN-2004-0597/98/99 multiple problems in libpng 1.2.5
CAN-2004-0597/98/99 multiple problems in libpng 1.2.5
libpng version up to and including 1.2.5 have a couple of secuirty holes.
Here are some CVE names
> 1) Remotely exploitable stack-based buffer overrun in
png_handle_tRNS
> (pngrutil.c)
> 2) Dangerous code in png_handle_sBIT (pngrutil.c) (Similar code in
> png_handle_hIST).
CAN-2004-0597 for these (we merge issues that have the same flaw type that
get fixed in the same versions).
> 3) Possible NULL-pointer crash in png_handle_iCCP (pngrutil.c) (this
> flaw is duplicated in multiple other locations).
CAN-2004-0598 for those
> 4) Theoretical integer overflow in allocation in png_handle_sPLT
> (pngrutil.c)
> 5) Integer overflow in png_read_png (pngread.c)
> 6) Integer overflows during progressive reading.
> 7) Other flaws. [
OWASP
Incubated Vulnerability
owasp·CVSS 9.3
CVE-2004-0200 [CRITICAL] Incubated Vulnerability
# Incubated Vulnerability
|ID |
|------------|
|WSTG-INJT-14|
## Summary
Also often referred to as persistent attacks, incubated testing is a complex testing method that needs more than one data validation vulnerability to work. Incubated vulnerabilities are typically used to conduct "watering hole" attacks against users of legitimate web applications.
Incubated vulnerabilities have the following characteristics:
- The attack vector needs to be persisted in the first place, it needs to be stored in the persistence layer, and this would only occur if weak data validation was present or the data arrived into the system via another channel such as an admin console or directly via a backend batch process.
- Secondly, once the attack vector was "recalled" the vector would need to be execut
OWASP
Testing for Incubated Vulnerability
owasp·CVSS 9.3
[CRITICAL] Testing for Incubated Vulnerability
# Testing for Incubated Vulnerability
|ID |
|------------|
|WSTG-INPV-14|
## Summary
Also often referred to as persistent attacks, incubated testing is a complex testing method that needs more than one data validation vulnerability to work. Incubated vulnerabilities are typically used to conduct "watering hole" attacks against users of legitimate web applications.
Incubated vulnerabilities have the following characteristics:
- The attack vector needs to be persisted in the first place, it needs to be stored in the persistence layer, and this would only occur if weak data validation was present or the data arrived into the system via another channel such as an admin console or directly via a backend batch process.
- Secondly, once the attack vector was "recalled" the vector would need
OWASP
Testing for Incubated Vulnerability
owasp·CVSS 9.3
CVE-2004-0200 [CRITICAL] Testing for Incubated Vulnerability
# Testing for Incubated Vulnerability
|ID |
|------------|
|WSTG-INJT-14|
## Summary
Also often referred to as persistent attacks, incubated testing is a complex testing method that needs more than one data validation vulnerability to work. Incubated vulnerabilities are typically used to conduct "watering hole" attacks against users of legitimate web applications.
Incubated vulnerabilities have the following characteristics:
- The attack vector needs to be persisted in the first place, it needs to be stored in the persistence layer, and this would only occur if weak data validation was present or the data arrived into the system via another channel such as an admin console or directly via a backend batch process.
- Secondly, once the attack vector was "recalled" the vector would need
ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txthttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856http://lists.apple.com/mhonarc/security-announce/msg00056.htmlhttp://marc.info/?l=bugtraq&m=109163866717909&w=2http://marc.info/?l=bugtraq&m=109181639602978&w=2http://marc.info/?l=bugtraq&m=109761239318458&w=2http://marc.info/?l=bugtraq&m=109900315219363&w=2http://marc.info/?l=bugtraq&m=110796779903455&w=2http://scary.beasts.org/security/CESA-2004-001.txthttp://secunia.com/advisories/22957http://secunia.com/advisories/22958http://sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-114816-02-1http://www.adobe.com/support/downloads/detail.jsp?ftpID=2679http://www.coresecurity.com/common/showdoc.php?idx=421&idxseccion=10http://www.debian.org/security/2004/dsa-536http://www.gentoo.org/security/en/glsa/glsa-200408-03.xmlhttp://www.gentoo.org/security/en/glsa/glsa-200408-22.xmlhttp://www.kb.cert.org/vuls/id/388984http://www.kb.cert.org/vuls/id/817368http://www.mandriva.com/security/advisories?name=MDKSA-2004:079http://www.mandriva.com/security/advisories?name=MDKSA-2006:212http://www.mandriva.com/security/advisories?name=MDKSA-2006:213http://www.mozilla.org/projects/security/known-vulnerabilities.htmlhttp://www.novell.com/linux/security/advisories/2004_23_libpng.htmlhttp://www.redhat.com/support/errata/RHSA-2004-402.htmlhttp://www.redhat.com/support/errata/RHSA-2004-421.htmlhttp://www.redhat.com/support/errata/RHSA-2004-429.htmlhttp://www.securityfocus.com/bid/10857http://www.securityfocus.com/bid/15495http://www.trustix.net/errata/2004/0040/http://www.us-cert.gov/cas/techalerts/TA04-217A.htmlhttp://www.us-cert.gov/cas/techalerts/TA05-039A.htmlhttps://bugzilla.fedora.us/show_bug.cgi?id=1943https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-009https://exchange.xforce.ibmcloud.com/vulnerabilities/16894https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11284https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2274https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2378https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4492https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A594https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7709ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2005.49/SCOSA-2005.49.txthttp://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000856http://lists.apple.com/mhonarc/security-announce/msg00056.htmlhttp://marc.info/?l=bugtraq&m=109163866717909&w=2http://marc.info/?l=bugtraq&m=109181639602978&w=2http://marc.info/?l=bugtraq&m=109761239318458&w=2http://marc.info/?l=bugtraq&m=109900315219363&w=2http://marc.info/?l=bugtraq&m=110796779903455&w=2http://scary.beasts.org/security/CESA-2004-001.txthttp://secunia.com/advisories/22957http://secunia.com/advisories/22958http://sunsolve.sun.com/search/document.do?assetkey=1-66-200663-1http://sunsolve.sun.com/search/document.do?assetkey=urn:cds:docid:1-21-114816-02-1http://www.adobe.com/support/downloads/detail.jsp?ftpID=2679http://www.coresecurity.com/common/showdoc.php?idx=421&idxseccion=10http://www.debian.org/security/2004/dsa-536http://www.gentoo.org/security/en/glsa/glsa-200408-03.xmlhttp://www.gentoo.org/security/en/glsa/glsa-200408-22.xmlhttp://www.kb.cert.org/vuls/id/388984http://www.kb.cert.org/vuls/id/817368http://www.mandriva.com/security/advisories?name=MDKSA-2004:079http://www.mandriva.com/security/advisories?name=MDKSA-2006:212http://www.mandriva.com/security/advisories?name=MDKSA-2006:213http://www.mozilla.org/projects/security/known-vulnerabilities.htmlhttp://www.novell.com/linux/security/advisories/2004_23_libpng.htmlhttp://www.redhat.com/support/errata/RHSA-2004-402.htmlhttp://www.redhat.com/support/errata/RHSA-2004-421.htmlhttp://www.redhat.com/support/errata/RHSA-2004-429.htmlhttp://www.securityfocus.com/bid/10857http://www.securityfocus.com/bid/15495http://www.trustix.net/errata/2004/0040/http://www.us-cert.gov/cas/techalerts/TA04-217A.htmlhttp://www.us-cert.gov/cas/techalerts/TA05-039A.htmlhttps://bugzilla.fedora.us/show_bug.cgi?id=1943https://docs.microsoft.com/en-us/security-updates/securitybulletins/2005/ms05-009https://exchange.xforce.ibmcloud.com/vulnerabilities/16894https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11284https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2274https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2378https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A4492https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A594https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7709
2004-11-23
Published