LibTIFF Buffer Overflows May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1011667 |
|
SecurityTracker URL: http://securitytracker.com/id/1011667
|
|
CVE Reference:
CAN-2004-0803
(Links to External Site)
|
Updated: Oct 14 2004
|
Original Entry Date: Oct 14 2004
|
Impact:
Execution of arbitrary code via network, User access via network
|
|
Version(s): 3.6.1
|
Description:
Some buffer overflow vulnerabilities were reported in LibTIFF. A remote user may be able to execute arbitrary code on the target user's system.
Gentoo reported that a remote user may be able to create a specially crafted image file that, when processed by the library, will execute arbitrary code with the privileges of the target user.
Chris Evans is credited with discovering these flaws.
The flaws reside in the RLE decoding routines in tif_next.c, tif_thunder.c, and potentially tif_luv.c.
Some demonstration exploit TIFFs are available at:
http://scary.beasts.org/misc/bad_next.tiff
http://scary.beasts.org/misc/bad_thunder.tiff
The original advisory is available at:
http://scary.beasts.org/security/CESA-2004-006.txt
|
Impact:
A remote user can create TIFF files that, when loaded by the target library, will execute arbitrary code.
|
Solution:
No upstream solution was available at the time of this entry.
|
Vendor URL: www.libtiff.org/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 13 Oct 2004 21:49:25 -0400
Subject: [none]
|
CVE: CAN-2004-0803
tiff: Buffer overflows in image decoding
Gentoo reported thatthere are several heap-based buffer overflows in the tiff library
image decoding routines. A remote user may be able to create a specially crafted
image file that, when processed by the library, will execute arbitrary code with
the privileges of the target user.
xv is also affected, as it links to the vulnerable tiff library.
|
|
