LIBPNG / LIBTTF Exploits?

Wally · Post by **Wally** » Tue May 22, 2007 12:21 pm

Hi Guys,

Was just browsing a security website known as FrSIRT and discovered that there were exploits in LIBPNG and LIBTTF

references:
http://www.frsirt.com/english/advisories/2007/1894 - libTTF
http://www.frsirt.com/english/advisories/2007/1838 - libPNG

If anything can be done, it would be great!

afiser · Post by **afiser** » Wed May 23, 2007 7:55 am

libTTF is a font library

and the libPNG vulnerability doesn't seem to cause an overflow so i doubt it can be useful.

Greatmetal · Post by **Greatmetal** » Wed May 23, 2007 1:55 pm

Last time I knew as a buffer overflow was a DOS type attack. Don't give up so easily asifer.

Greatmetal · Post by **Greatmetal** » Thu May 24, 2007 4:31 pm

Why is no one giving their input on this? It needs to be looked at in case it is a usable exploit :/.

Raphael · Post by **Raphael** » Thu May 24, 2007 6:38 pm

TTF will at most lead to an exploit in the browser and that will at most give user mode access. So that's not the best point to look for. The PNG exploit on the other side was labeled 'low risc', so I'm not sure if that will be useable at all.

ufoz · Post by **ufoz** » Thu May 24, 2007 7:22 pm

The PSP firmware uses its own proprietary font system, not TTF, so that one isn't even applicable.
Anyway, I thought we don't really discuss exploits here...?

Wally · Post by **Wally** » Thu May 24, 2007 9:54 pm

Raphael wrote:TTF will at most lead to an exploit in the browser and that will at most give user mode access. So that's not the best point to look for. The PNG exploit on the other side was labeled 'low risc', so I'm not sure if that will be useable at all.

User mode can lead to full access though anyway (As seen in the past)

And it would keep those people on 3.10 - 3.40 happy where they can run Nes or something without the need of access to the kernel..

its just a new chapter :P

Raphael · Post by **Raphael** » Fri May 25, 2007 12:22 am

Wally4000 wrote: User mode can lead to full access though anyway (As seen in the past)

Not unless another exploit in the kernel functions is found. And THAT is the real problem about it, so I'd rather first investigate for such exploits. But I'm not the man for that anyway, so I don't care really.

Wally · Post by **Wally** » Fri May 25, 2007 12:45 am

Thats understandable.

I tried to sick skylark onto it, but hes lazy :P

Wally