===================================================================== CERT-Renater Note d'Information No. 2005/VULN412 _____________________________________________________________________ DATE : 27/06/2005 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems running GNOME 2.0 Desktop, Sun Java Desktop System 2003. ====================================================================== Sun(sm) Alert Notification * Sun Alert ID: 101776 * Synopsis: Security Vulnerabilities in The " libgdk_pixbuf" Library May Allow a Remote Unprivileged User the ability to Execute Arbitrary Code * Category: Security * Product: GNOME 2.0 Desktop, Sun Java Desktop System 2003 * BugIDs: 5103573 * Avoidance: Patch, Workaround * State: Workaround * Date Released: 23-Jun-2005 * Date Closed: * Date Modified: 1. Impact Due to multiple security vulnerabilities in the libgdk_pixbuf library, a remote unprivileged user may be able to execute arbitrary code with the privileges of a local user when that local user has loaded an XPixmap (Xpm) format image file supplied by an untrusted user. The libgdk_pixbuf library is part of the GIMP Toolkit (GTK+) and is used for loading and rendering images. These issues are described in the following documents: * http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0782 * http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0783 2. Contributing Factors These issues can occur in the following releases: SPARC Platform: * GNOME 2.0 (for Solaris 8) without patch 114644-03 * GNOME 2.0 (for Solaris 9) without patch 114686-03 * GNOME 2.0.2 (for Solaris 9)without patch 115738-04 x86 Platform * GNOME 2.0 (for Solaris 8) without patch 114645-03 * GNOME 2.0 (for Solaris 9) without patch 114687-03 * GNOME 2.0.2 (for Solaris 9) * Solaris 9 with JDS release 2 installed Linux * Sun Java Desktop System (JDS) 2003 without the updated RPMs (patch-118903-01) * Sun Java Desktop System (JDS) Release 2 without the updated RPMs (patch-118905-01) Note: Solaris 10 is not affected by these issues. To determine the version of GNOME that is currently installed on the system, the following command can be run (output will vary by platform): % grep description /usr/share/gnome/gnome-about/gnome-version.xml fcs-10b for GNOME 2.0 releases 2.0.0_patch-us2 Alternatively (for the same results), in a terminal window from within the GNOME desktop, the following command can be run: % /usr/bin/gnome-about To determine the release of JDS for Linux installed on a system, the following command can be run: % cat /etc/sun-release Sun Java Desktop System - 2003 To determine if JDS release 2 is installed on a Solaris 9 system, the following command can be run: % grep distributor-version /usr/share/gnome-about/gnome-version.xml Sun Java Desktop System, Release 2 To determine the version of GTK on JDS for Linux systems, run the following command: % rpm -qf /usr/lib/gtk-2.0/2.2.0/loaders/libpixbufloader-xpm.so gtk2-2.2.2-30 3. Symptoms There are no reliable symptoms that would indicate the described issues have been exploited. 4. Relief/Workaround To work around the described issues, do not load XPixmap (Xpm) images from untrusted sources. 5. Resolution These issues are addressed in the following releases: SPARC Platform * GNOME 2.0 (for Solaris 8) with patch 114644-03 or later * GNOME 2.0 (for Solaris 9) with patch 114686-03 or later * GNOME 2.0.2 (for Solaris 9)with patch 115738-04 or later x86 Platform * GNOME 2.0 (for Solaris 8) with patch 114645-03 or later * GNOME 2.0 (for Solaris 9) with patch 114687-03 or later Linux * Sun Java Desktop System (JDS) 2003 with the updated RPMs (patch-118903-01) * Sun Java Desktop System (JDS) Release 2 with the updated RPMs (patch-118905-01) To download and install the updated RPMs from the update servers, select the following sequence from the "launch" bar: Launch >> Applications >> System Tools >> Online Update For more information on obtaining RPM updates, see: * http://wwws.sun.com/software/javadesktopsystem/faq.html#5q5 * http://wwws.sun.com/software/javadesktopsystem/faq.html#5q7 A final resolution is pending completion. This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements. Copyright 2000-2005 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================