Two separate imaging-related security flaws have surfaced in AOL's Netscape browser and in the KDE desktop environment for Unix and Linux, according to security experts. Both could allow an attacker to plant malicious code on a user's system when a specially crafted image is viewed by an affected application, such as a browser, e-mail program or stand-alone viewer, researchers said.
Vulnerabilities in image-viewing components are among the easiest to exploit, particularly when they affect Internet-connected applications such as browsers and email programs, say experts. "If the libraries are used by other types of client applications, where the user has to download a malicious file and open it in a specific application, it complicates the attack a bit," said Thomas Kristensen, CTO of security firm Secunia.
Last September, for instance, attackers exploited a flaw in the way Windows handled JPEG images to spread malicious code through an e-mail worm and porn images planted on newsgroups. In November, attackers used a separate problem -- involving IFRAME handling in Explorer 6 -- to infect PCs via ad banners placed on several high-profile websites.
The flaw in Netscape, affecting versions 6.x and 7.x, involves a boundary error in the way Netscape extension 2 blocks handle gif images, according to Internet Security Systems, which disclosed the flaw last month; the bug was patched in Mozilla-based products in March.
But the gif flaw also affects Netscape, and is unpatched, Secunia said in an advisory published on Tuesday. The vulnerability has been confirmed in version 7.2 and also reported in version 6.2.3 but is likely to affect other versions as well, Secunia said.
Netscape is based on Mozilla browsers but is developed by AOL, with the support of outside contractors, since the company has greatly reduced its Netscape development team. The browser team either doesn't patch flaws very promptly or doesn't publicize its patches, Kristensen said. According to Secunia's vulnerability database, 53 percent of Netscape 7.x vulnerabilities are unpatched, with 29 percent of Netscape 6.x bugs unpatched.
"Unless they patch things silently, then it doesn't seem very prompt compared with the other browser vendors," Kristensen said.
A separate vulnerability affects KDE's kdelibs, specifically an error in the kimgio component when processing PCX image files. Kimgio is used in KHTML-based Web browsers as well as KDE imaging applications such as kpresenter and ksnapshot, meaning that if an image crafted to exploit the flaw were viewed in any of these applications, they could allow an attacker to execute malicious code. The flaw affects KDE versions 3.2 to 3.4, Secunia said.
A patch is available from KDE and from various Linux distributors, including Suse, Gentoo and Debian.
Recent image-related flaws include a flaw in Linux's imlib library in December and libtiff in January, and in Windows' LoadImage component in January.
A bug in PHP servers disclosed earlier this month could be exploited via tags embedded in EXIF images, a format used by digital cameras.
Join the CIO New Zealand group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.