Vulnerability Note VU#687568
LibTIFF contains multiple integer overflows
OverviewMultiple integer overflows in the LibTIFF library may allow an attacker to execute arbitrary code.
I. DescriptionLibTIFF is a library used to encode and decode images in Tag Image File Format (TIFF) format. A number of potential integer overflow errors exist in the LibTIFF library. A lack of input validation on user-controlled data may allow a remote attacker to manipulate calls to the malloc() routine.
One instance of these vulnerabilities is in the TIFFFetchStripThing()routine within the tif_dirread.c file. A lack of validation on data specifying the size of an TIFF image may allow a remote attacker to manipulte malloc()to create a buffer with insufficient size. When data is copied to this under-sized buffer, a heap-based buffer overflow may occur. In order to exploit this specific attack vector, an attacker must craft a TIFF image with the STRIPOFFSETS flag set.
Please note that other routines may be vulnerable. In addition, any application that uses the LibTIFF library may be affected by this issue. Users are encouraged to contact their vendors to determine if they are vulnerable.
II. ImpactDepending on the application being used and the attack vector being exploited, potential consequences range from a denial-of-service condition to the execution of arbitrary code with the privileges of the LibTIFF process.
III. SolutionApply Patch
Patch or upgrade as specified by your vendor. Users who suspect they are vulnerable are encouraged to check with their vendor to determine the appropriate action to take.
Systems Affected
References
http://secunia.com/advisories/12818/
http://www.ciac.org/ciac/bulletins/p-015.shtml
http://securitytracker.com/alerts/2004/Oct/1011674.html
http://seclists.org/lists/bugtraq/2004/Oct/0135.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0886
http://www.osvdb.org/displayvuln.php?osvdb_id=10751
http://securitytracker.com/alerts/2004/Dec/1012651.html
http://www.idefense.com/application/poi/display?id=173&type=vulnerabilities
Credit
This vulnerability was reported in Secunia Security Advisory SA12818.
Secunia credits Matthias Clasen for providing information regarding this vulnerability.
This document was written by Jeff Gennari.
Other Information
| Date Public | 10/14/2004 |
| Date First Published | 12/01/2004 09:26:06 AM |
| Date Last Updated | 01/25/2005 |
| CERT Advisory | |
| CVE-ID(s) | CAN-2004-0886 |
| NVD-ID(s) | CAN-2004-0886 |
| US-CERT Technical Alerts | |
| Metric | 10.33 |
| Document Revision | 129 |
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
Get Adobe Reader