CHMlib: User-assisted remote execution of arbitrary code

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - -
Gentoo Linux Security Advisory                          
GLSA 200702-12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - -
                                            http://security.gentoo.or
g/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - -

  Severity: Normal
     Title: CHMlib: User-assisted remote execution of
arbitrary code
      Date: February 27, 2007
      Bugs: #163989
        ID: 200702-12

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - -

Synopsis
========

A memory corruption vulnerability in CHMlib could lead to
the remote
execution of arbitrary code.

Background
==========

CHMlib is a library for the MS CHM (Compressed HTML) file
format plus
extracting and HTTP server utils.

Affected packages
=================

   
------------------------------------------------------------
-------
     Package         /  Vulnerable  /                      
Unaffected
   
------------------------------------------------------------
-------
  1  app-doc/chmlib       < 0.39                         
     >= 0.39

Description
===========

When certain CHM files that contain tables and objects
stored in pages
are parsed by CHMlib, an unsanitized value is passed to the
alloca()
function resulting in a shift of the stack pointer to
arbitrary memory
locations.

Impact
======

An attacker could entice a user to open a specially crafted
CHM file,
resulting in the execution of arbitrary code with the
permissions of
the user viewing the file.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All CHMlib users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose
">=app-doc/chmlib-0.39"

References
==========

  [ 1 ] Original Advisory
        http://labs.idefense.com/intelligence/vu
lnerabilities/display.php?id=468
  [ 2 ] CVE-2007-0619
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-200
7-0619

Availability
============

This GLSA and any updates to it are available for viewing
at
the Gentoo Security Website:

  ht
tp://security.gentoo.org/glsa/glsa-200702-12.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring
the
confidentiality and security of our users machines is of
utmost
importance to us. Any security concerns should be addressed
to
securitygentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2007 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://
creativecommons.org/licenses/by-sa/2.5