Linux vendors warn of security holes

Patch, or avoid 'unfamiliar' archives

Major Linux vendors, including Novell, Red Hat, the Gentoo Foundation and MandrakeSoft have warned of potential security holes in two Linux components. The vulnerabilities are related to LHA, a compression module, and lmlib, a library used in graphics viewing applications in Gnome. Patches are available to correct both possible flaws.

Marcus Meissner of Novell’s SUSE Linux said Imlib contains a bug that enables execution of harmful code if a user is fooled into viewing a series of tainted bitmap image files. Danish security firm Secunia explained that the security flaw is due to a boundary error in the decoding of runlength-encoded bitmap images. In such a case, a buffer overflow can be initiated. Many viruses cause buffer overruns, although the way by which they gain entry varies.

lmlib 1.x and limlib2 1.x are vulnerable. The Gnome project has issued patches, as have Linux vendors Gentoo and MandrakeSoft.

Gentoo also has patches available for a bug that was discovered by Red Hat. LHA, a utility for compressing and decompressing LHarc-format archives, could allow the execution of malicious code, according to Red Hat. However, unlike the lmlib bug, a user can execute a malicious archive or pass a specially-crafted command line to the lha command if one were tricked into testing the infected archive or extracting its contents. The bug affects all versions up to and including 1.14.

A patch is available from Red Hat. A universal precaution, as Secunia noted, is to stay away from archives that a user is not familiar with.