Pair of Linux Holes Put Users at Risk

Linux users are at risk from serious security vulnerabilities in components used to view graphics and handle archives, according to researchers. The security holes, found in the imlib graphics library and the LHA archive tool, can be exploited via a specially crafted bitmap image or an LHarc-format archive to take over a Linux system.

The GNOME graphical user interface project this week released a patch for imlib, a basic library used in many image-viewing applications. The bug was first identified late last month by Novell SuSE Linuxs Marcus Meissner, but was not thought to be serious. Later, developers realized the problem could be exploited to cause a buffer overflow and execute malicious code if a user viewed a graphic in any imlib-based application, for example a Web browser.

Imlib 1.x and imlib2 1.x are affected, researchers said. MandrakeSoft, Gentoo and other Linux vendors are releasing patches for the flaw.

The bug is related to a graphics-processing vulnerability publicized last month in Qt, a software toolkit used in writing GUI applications using the X Window system in Unix and Linux, according to an advisory from Danish security firm Secunia. Security researcher Chris Evans discovered a bug in Qts BMP decoder that could allow an attacker to use a specially crafted bitmap file to crash any application using the Qt BMP decoder, potentially also executing malicious code.

For insights on security coverage around the Web, check out eWEEK.com Security Center Editor Larry Seltzers Weblog.

The three LHA bugs are as serious as that in imlib, but are more difficult to exploit, according to an advisory from Red Hat Inc. The first could take effect if a user were tricked into extracting or testing a specially crafted archive. The second can only be exploited if a user were tricked into passing a specially crafted command line to the lha command. In the third, an attacker could create a directory with special characters in its name, which could lead to the execution of malicious commands. All three affect LHA versions up to and including 1.14.

The vulnerability was identified at the beginning of this month, but patches for Linux distributions including Gentoo and Fedora only became available on Wednesday. In an advisory, Secunia noted that users can avoid the problem by using another product or by avoiding untrusted archives.

Resource Library:

Check out eWEEK.coms Linux & Open Source Center for the latest open-source news, reviews and analysis.

Be sure to add our eWEEK.com Linux news feed to your RSS newsreader or My Yahoo page