SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Multimedia)  >   LibTIFF Vendors:   libtiff.org
(Fedora Issues Fix for FC2) LibTIFF Buffer Overflows May Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1011701
SecurityTracker URL:  http://securitytracker.com/id/1011701
CVE Reference:   CVE-2004-0803   (Links to External Site)
Date:  Oct 15 2004
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.6.1
Description:   Some buffer overflow vulnerabilities were reported in LibTIFF. A remote user may be able to execute arbitrary code on the target user's system.

Gentoo reported that a remote user may be able to create a specially crafted image file that, when processed by the library, will execute arbitrary code with the privileges of the target user.

Chris Evans is credited with discovering these flaws.

The flaws reside in the RLE decoding routines in tif_next.c, tif_thunder.c, and potentially tif_luv.c.

Some demonstration exploit TIFFs are available at:

http://scary.beasts.org/misc/bad_next.tiff

http://scary.beasts.org/misc/bad_thunder.tiff

The original advisory is available at:

http://scary.beasts.org/security/CESA-2004-006.txt

Impact:   A remote user can create TIFF files that, when loaded by the target library, will execute arbitrary code.
Solution:   Fedora has released a fix, available at:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/

176b76f644d44964a485e71ea09c814b SRPMS/libtiff-3.5.7-20.2.src.rpm
a53252dfa36355bc7afb44f68de3534f x86_64/libtiff-3.5.7-20.2.x86_64.rpm
72f0b77f45916d20a8517d7cf9b80e1d
x86_64/libtiff-devel-3.5.7-20.2.x86_64.rpm
7b17b8e556b04850231efef0e38bf582
x86_64/debug/libtiff-debuginfo-3.5.7-20.2.x86_64.rpm
f86f0dec436740a312ad310140a3d537 x86_64/libtiff-3.5.7-20.2.i386.rpm
f86f0dec436740a312ad310140a3d537 i386/libtiff-3.5.7-20.2.i386.rpm
d78da339e6ac75c8bad8d6c87ca8c232 i386/libtiff-devel-3.5.7-20.2.i386.rpm
fcb92220b830cce1c65a844d52e6d07d
i386/debug/libtiff-debuginfo-3.5.7-20.2.i386.rpm

Vendor URL:  www.libtiff.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Red Hat Fedora)
Underlying OS Comments:  FC2

Message History:   This archive entry is a follow-up to the message listed below.
Oct 14 2004 LibTIFF Buffer Overflows May Let Remote Users Execute Arbitrary Code



 Source Message Contents

Subject:  [SECURITY] Fedora Core 2 Update: libtiff-3.5.7-20.2


---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2004-334
2004-10-14
---------------------------------------------------------------------

Product     : Fedora Core 2
Name        : libtiff
Version     : 3.5.7                      
Release     : 20.2                  
Summary     : A library of functions for manipulating TIFF format image
files.
Description :
The libtiff package contains a library of functions for manipulating
TIFF (Tagged Image File Format) image format files.  TIFF is a widely
used file format for bitmapped images.  TIFF files usually end in the
.tif extension and they are often quite large.

The libtiff package should be installed if you need to manipulate TIFF
format image files.

---------------------------------------------------------------------
Update Information:

The libtiff package contains a library of functions for manipulating
TIFF
(Tagged Image File Format) image format files. TIFF is a widely used
file
format for bitmapped images.

During a source code audit, Chris Evans discovered a number of integer
overflow bugs that affect libtiff. An attacker who has the ability to
trick
a user into opening a malicious TIFF file could cause the application
linked to libtiff to crash or possibly execute arbitrary code. The
Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2004-0886 to this issue.

Additionally, a number of buffer overflow bugs that affect libtiff have
been found. An attacker who has the ability to trick a user into opening
a
malicious TIFF file could cause the application linked to libtiff to
crash
or possibly execute arbitrary code. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0803 to
this issue.

All users are advised to upgrade to these errata packages, which contain
fixes for these issues. 
---------------------------------------------------------------------
* Thu Oct 07 2004 Matthias Clasen <mclasen@redhat.com>

- fix some integer and buffer overflows (#134853, #134848)


---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/

176b76f644d44964a485e71ea09c814b  SRPMS/libtiff-3.5.7-20.2.src.rpm
a53252dfa36355bc7afb44f68de3534f  x86_64/libtiff-3.5.7-20.2.x86_64.rpm
72f0b77f45916d20a8517d7cf9b80e1d 
x86_64/libtiff-devel-3.5.7-20.2.x86_64.rpm
7b17b8e556b04850231efef0e38bf582 
x86_64/debug/libtiff-debuginfo-3.5.7-20.2.x86_64.rpm
f86f0dec436740a312ad310140a3d537  x86_64/libtiff-3.5.7-20.2.i386.rpm
f86f0dec436740a312ad310140a3d537  i386/libtiff-3.5.7-20.2.i386.rpm
d78da339e6ac75c8bad8d6c87ca8c232  i386/libtiff-devel-3.5.7-20.2.i386.rpm
fcb92220b830cce1c65a844d52e6d07d 
i386/debug/libtiff-debuginfo-3.5.7-20.2.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.  
---------------------------------------------------------------------



--
fedora-announce-list mailing list
fedora-announce-list@redhat.com
http://www.redhat.com/mailman/listinfo/fedora-announce-list

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC