Vulnerability Note VU#687568

LibTIFF is a library used to encode and decode images in Tag Image File Format (TIFF) format. A number of potential integer overflow errors exist in the LibTIFF library. A lack of input validation on user-controlled data may allow a remote attacker to manipulate calls to the malloc() routine.

One instance of these vulnerabilities is in the TIFFFetchStripThing()routine within the tif_dirread.c file. A lack of validation on data specifying the size of an TIFF image may allow a remote attacker to manipulte malloc()to create a buffer with insufficient size. When data is copied to this under-sized buffer, a heap-based buffer overflow may occur. In order to exploit this specific attack vector, an attacker must craft a TIFF image with the STRIPOFFSETS flag set.

Please note that other routines may be vulnerable. In addition, any application that uses the LibTIFF library may be affected by this issue. Users are encouraged to contact their vendors to determine if they are vulnerable.

Depending on the application being used and the attack vector being exploited, potential consequences range from a denial-of-service condition to the execution of arbitrary code with the privileges of the LibTIFF process.

Apply Patch

Patch or upgrade as specified by your vendor. Users who suspect they are vulnerable are encouraged to check with their vendor to determine the appropriate action to take.