Vulnerabilities > CVE-2007-5378 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in TCL TK Toolkit
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
PARTIAL Summary
Buffer overflow in the FileReadGIF function in tkImgGIF.c for Tk Toolkit 8.4.12 and earlier, and 8.3.5 and earlier, allows user-assisted attackers to cause a denial of service (segmentation fault) via an animated GIF in which the first subimage is smaller than a subsequent subimage, which triggers the overflow in the ReadImage function, a different vulnerability than CVE-2007-5137.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2008-0134.NASL description Updated tcltk packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, and 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Tcl is a scripting language designed for embedding into other applications and for use with Tk, a widget set. An input validation flaw was discovered in Tk last seen 2020-06-01 modified 2020-06-02 plugin id 31139 published 2008-02-25 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/31139 title CentOS 3 : tcltk (CESA-2008:0134) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0134.NASL description Updated tcltk packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, and 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Tcl is a scripting language designed for embedding into other applications and for use with Tk, a widget set. An input validation flaw was discovered in Tk last seen 2020-06-01 modified 2020-06-02 plugin id 31160 published 2008-02-25 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/31160 title RHEL 2.1 / 3 : tcltk (RHSA-2008:0134) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2008-0135.NASL description From Red Hat Security Advisory 2008:0135 : Updated tk packages that fix a security issue are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. [Updated 22 February 2008] The packages in this errata were originally pushed to the wrong Red Hat Network channels and were not available to all users. We have updated this errata with the correct channels. Tk is a graphical toolkit for the Tcl scripting language. An input validation flaw was discovered in Tk last seen 2020-06-01 modified 2020-06-02 plugin id 67654 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67654 title Oracle Linux 4 : tk (ELSA-2008-0135) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-529-1.NASL description It was discovered that Tk could be made to overrun a buffer when loading certain images. If a user were tricked into opening a specially crafted GIF image, remote attackers could cause a denial of service or execute arbitrary code with user privileges. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 28134 published 2007-11-10 reporter Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/28134 title Ubuntu 6.06 LTS / 6.10 / 7.04 : tk8.3, tk8.4 vulnerability (USN-529-1) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0135.NASL description Updated tk packages that fix a security issue are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. [Updated 22 February 2008] The packages in this errata were originally pushed to the wrong Red Hat Network channels and were not available to all users. We have updated this errata with the correct channels. Tk is a graphical toolkit for the Tcl scripting language. An input validation flaw was discovered in Tk last seen 2020-06-01 modified 2020-06-02 plugin id 31161 published 2008-02-25 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/31161 title RHEL 4 : tk (RHSA-2008:0135) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2008-0134.NASL description From Red Hat Security Advisory 2008:0134 : Updated tcltk packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, and 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Tcl is a scripting language designed for embedding into other applications and for use with Tk, a widget set. An input validation flaw was discovered in Tk last seen 2020-06-01 modified 2020-06-02 plugin id 67653 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67653 title Oracle Linux 3 : tcltk (ELSA-2008-0134) NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2007-200.NASL description A vulnerability in Tk was found that could be used to overrun a buffer when loading certain GIF images. If a user were tricked into opening a specially crafted GIF file, it could lead to a denial of service condition or possibly the execution of arbitrary code with the user last seen 2020-06-01 modified 2020-06-02 plugin id 27519 published 2007-10-19 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27519 title Mandrake Linux Security Advisory : tk (MDKSA-2007:200) NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2008-041.NASL description The ReadImage() function in Tk did not check codeSize read from GIF images prior to initializing the append array, which could lead to a buffer overflow with unknown impact. The updated packages have been patched to correct this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 36297 published 2009-04-23 reporter This script is Copyright (C) 2009-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/36297 title Mandriva Linux Security Advisory : tk (MDVSA-2008:041) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1416.NASL description It was discovered that Tk, a cross-platform graphical toolkit for Tcl, performs insufficient input validation in the code used to load GIF images, which may lead to the execution of arbitrary code. Due to the technical limitation in the Debian archive scripts the update for the old stable distribution (sarge) cannot be released in sync with the update for the stable distribution. It will be provided in the next days. last seen 2020-06-01 modified 2020-06-02 plugin id 28339 published 2007-11-29 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/28339 title Debian DSA-1416-1 : tk8.3 - buffer overflow NASL family Scientific Linux Local Security Checks NASL id SL_20080221_TCLTK_ON_SL3_X.NASL description An input validation flaw was discovered in Tk last seen 2020-06-01 modified 2020-06-02 plugin id 60362 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60362 title Scientific Linux Security Update : tcltk on SL3.x i386/x86_64 NASL family Scientific Linux Local Security Checks NASL id SL_20080221_TK_ON_SL4_X.NASL description An input validation flaw was discovered in Tk last seen 2020-06-01 modified 2020-06-02 plugin id 60363 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60363 title Scientific Linux Security Update : tk on SL4.x, SL5.x i386/x86_64 NASL family VMware ESX Local Security Checks NASL id VMWARE_VMSA-2008-0009.NASL description a. VMware Tools Local Privilege Escalation on Windows-based guest OS The VMware Tools Package provides support required for shared folders (HGFS) and other features. An input validation error is present in the Windows-based VMware HGFS.sys driver. Exploitation of this flaw might result in arbitrary code execution on the guest system by an unprivileged guest user. It doesn last seen 2020-06-01 modified 2020-06-02 plugin id 40378 published 2009-07-27 reporter This script is Copyright (C) 2009-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/40378 title VMSA-2008-0009 : Updates to VMware Workstation, VMware Player, VMware ACE, VMware Fusion, VMware Server, VMware VIX API, VMware ESX, VMware ESXi resolve critical security issues NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2008-0135.NASL description Updated tk packages that fix a security issue are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. [Updated 22 February 2008] The packages in this errata were originally pushed to the wrong Red Hat Network channels and were not available to all users. We have updated this errata with the correct channels. Tk is a graphical toolkit for the Tcl scripting language. An input validation flaw was discovered in Tk last seen 2020-06-01 modified 2020-06-02 plugin id 31140 published 2008-02-25 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/31140 title CentOS 4 : tk (CESA-2008:0135) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1743.NASL description Two buffer overflows have been found in the GIF image parsing code of Tk, a cross-platform graphical toolkit, which could lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2007-5137 It was discovered that libtk-img is prone to a buffer overflow via specially crafted multi-frame interlaced GIF files. - CVE-2007-5378 It was discovered that libtk-img is prone to a buffer overflow via specially crafted GIF files with certain subimage sizes. last seen 2020-06-01 modified 2020-06-02 plugin id 35932 published 2009-03-17 reporter This script is Copyright (C) 2009-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/35932 title Debian DSA-1743-1 : libtk-img - buffer overflows NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1415.NASL description It was discovered that Tk, a cross-platform graphical toolkit for Tcl, performs insufficient input validation in the code used to load GIF images, which may lead to the execution of arbitrary code. last seen 2020-06-01 modified 2020-06-02 plugin id 28338 published 2007-11-29 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/28338 title Debian DSA-1415-1 : tk8.4 - buffer overflow
Oval
| accepted | 2013-04-29T04:19:40.221-04:00 | ||||||||||||||||||||
| class | vulnerability | ||||||||||||||||||||
| contributors |
| ||||||||||||||||||||
| definition_extensions |
| ||||||||||||||||||||
| description | Buffer overflow in the FileReadGIF function in tkImgGIF.c for Tk Toolkit 8.4.12 and earlier, and 8.3.5 and earlier, allows user-assisted attackers to cause a denial of service (segmentation fault) via an animated GIF in which the first subimage is smaller than a subsequent subimage, which triggers the overflow in the ReadImage function, a different vulnerability than CVE-2007-5137. | ||||||||||||||||||||
| family | unix | ||||||||||||||||||||
| id | oval:org.mitre.oval:def:9480 | ||||||||||||||||||||
| status | accepted | ||||||||||||||||||||
| submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||
| title | Buffer overflow in the FileReadGIF function in tkImgGIF.c for Tk Toolkit 8.4.12 and earlier, and 8.3.5 and earlier, allows user-assisted attackers to cause a denial of service (segmentation fault) via an animated GIF in which the first subimage is smaller than a subsequent subimage, which triggers the overflow in the ReadImage function, a different vulnerability than CVE-2007-5137. | ||||||||||||||||||||
| version | 26 |
Redhat
| advisories |
| ||||||||
| rpms |
|
Statements
| contributor | Mark J Cox |
| lastmodified | 2007-10-16 |
| organization | Red Hat |
| statement | Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2007-5378 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw. |
References
- http://secunia.com/advisories/27207
- http://secunia.com/advisories/27295
- http://secunia.com/advisories/27801
- http://secunia.com/advisories/27806
- http://secunia.com/advisories/29070
- http://secunia.com/advisories/30129
- http://secunia.com/advisories/30535
- http://secunia.com/advisories/34297
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-237465-1
- http://www.attrition.org/pipermail/vim/2007-October/001826.html
- http://www.debian.org/security/2007/dsa-1415
- http://www.debian.org/security/2007/dsa-1416
- http://www.debian.org/security/2009/dsa-1743
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:200
- http://www.redhat.com/support/errata/RHSA-2008-0134.html
- http://www.redhat.com/support/errata/RHSA-2008-0135.html
- http://www.securityfocus.com/archive/1/493080/100/0/threaded
- http://www.securityfocus.com/bid/26056
- http://www.ubuntu.com/usn/usn-529-1
- http://www.vmware.com/security/advisories/VMSA-2008-0009.html
- http://www.vupen.com/english/advisories/2008/1456/references
- http://www.vupen.com/english/advisories/2008/1744
- https://exchange.xforce.ibmcloud.com/vulnerabilities/37189
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9480
- https://sourceforge.net/tracker/?func=detail&atid=112997&aid=1458234&group_id=12997