Heap Buffer Overflow in GIMP PSP File Parser

Executive Summary

This vulnerability is a heap buffer overflow found in GIMP's Paint Shop Pro (PSP) file format parser. It happens because the software incorrectly calculates buffer sizes when processing low bit-depth images (depth of 1 or 4). Specifically, the function responsible for reading image data allocates too small a buffer due to a miscalculation involving pixel packing, but then reads more data than the buffer can hold. This causes an overflow of adjacent memory on the heap.

An attacker can exploit this by tricking a user into opening a specially crafted PSP image file, which can lead to arbitrary code execution or a denial of service (DoS).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including allowing a remote attacker to execute arbitrary code on your system or cause a denial of service (DoS) by crashing the application. This means that if you open a malicious PSP image file, your system could be compromised or the GIMP application could become unstable or stop working.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is triggered when a specially crafted Paint Shop Pro (PSP) image file is opened in GIMP, causing a heap buffer overflow. Detection involves identifying attempts to open or process such malicious PSP files.

Since the vulnerability arises from processing low bit-depth PSP images (depth=1 or 4) with malformed buffer sizes, monitoring for suspicious PSP files or unusual GIMP crashes when opening PSP files can be indicative.

There are no specific commands provided in the resources to detect this vulnerability directly. However, general detection steps could include:

• Monitoring file access logs for PSP files being opened.
• Using file integrity monitoring tools to detect unexpected PSP files.
• Checking GIMP crash logs or system logs for crashes related to PSP file processing.

For more precise detection, one might consider using fuzzing or static analysis tools on the GIMP PSP parser code, but no direct commands or signatures are provided.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to avoid opening untrusted or unknown Paint Shop Pro (PSP) image files in GIMP, especially those with low bit-depth images.

Applying the upstream patch that corrects the buffer allocation in the read_channel_data() function is the definitive fix.

If a patched version of GIMP is available from your vendor or distribution, update to that version promptly.

As a temporary workaround, consider disabling PSP file format support in GIMP if possible, or restrict usage to trusted PSP files only.

Useful 0 Not Useful 0