Signature Detail
Short Name |
HTTP:STC:IMG:BMP-WIDTH-OF |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
Overlarge BMP Width Parameter |
Release Date |
2004/10/06 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: Overlarge BMP Width Parameter
This signature detects large bitmap (BMP) files that contain a large width parameter. Attackers can post a BMP file that, when viewed in Mozilla or FireFox Web browser, crashes the browser's system. In some extreme cases, attackers can run arbitrary code on the browser's system. Note: A very wide non-malicious BMP can also trigger this signature.
Extended Description
Mozilla Browser is reportedly prone to multiple integer overflow vulnerabilities in the image parsing routines. These issues exist due to insufficient boundary checks performed by the application. A remote attacker may cause denial of service conditions in the client or execute arbitrary code to gain unauthorized access to a vulnerable computer. These vulnerabilities were researched on Mozilla 1.7, however, other versions may be affected as well. Thunderbird 0.7 was also tested.
Affected Products
- Conectiva Linux 10.0.0
- Conectiva Linux 9.0.0
- Mozilla Browser 1.7.0
- Mozilla Browser 1.7.0 Rc3
- Mozilla Browser 1.7.1
- Mozilla Browser 1.7.2
- Mozilla Firebird 0.5.0
- Mozilla Firefox 0.8.0
- Mozilla Firefox 0.9.0
- Mozilla Firefox 0.9.0 Rc
- Mozilla Firefox 0.9.1
- Mozilla Firefox 0.9.2
- Mozilla Firefox 0.9.3
- Mozilla Thunderbird 0.6.0
- Mozilla Thunderbird 0.7.0
- Mozilla Thunderbird 0.7.1
- Mozilla Thunderbird 0.7.2
- Mozilla Thunderbird 0.7.3
- Netscape Navigator 7.0.0
- Netscape Navigator 7.0.2
- Netscape Navigator 7.1.0
- Netscape Navigator 7.2.0
- Red Hat Advanced Workstation for the Itanium Processor 2.1.0
- Red Hat Advanced Workstation for the Itanium Processor 2.1.0 IA64
- Red Hat Desktop 3.0.0
- Red Hat Enterprise Linux AS 2.1
- Red Hat Enterprise Linux AS 2.1 IA64
- Red Hat Enterprise Linux AS 3
- Red Hat Enterprise Linux ES 2.1
- Red Hat Enterprise Linux ES 2.1 IA64
- Red Hat Enterprise Linux ES 3
- Red Hat Enterprise Linux WS 2.1
- Red Hat Enterprise Linux WS 2.1 IA64
- Red Hat Enterprise Linux WS 3
- Red Hat Fedora Core1
- Red Hat Linux 7.3.0
- Red Hat Linux 7.3.0 I386
- Red Hat Linux 7.3.0 I686
- Red Hat Linux 9.0.0 I386
References
- BugTraq: 11171
- CVE: CVE-2004-0904
- URL: http://www.kb.cert.org/vuls/id/847200
- URL: http://bugzilla.mozilla.org/show_bug.cgi?id=255067