Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
(Red Hat Issues Fix) LibTIFF Buffer Overflows May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1011903 |
|
SecurityTracker URL: http://securitytracker.com/id/1011903
|
|
CVE Reference:
CAN-2004-0803
(Links to External Site)
|
Date: Oct 23 2004
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 3.6.1
|
Description:
Some buffer overflow vulnerabilities were reported in LibTIFF. A remote user may be able to execute arbitrary code on the target user's system.
Gentoo reported that a remote user may be able to create a specially crafted image file that, when processed by the library, will execute arbitrary code with the privileges of the target user.
Chris Evans is credited with discovering these flaws.
The flaws reside in the RLE decoding routines in tif_next.c, tif_thunder.c, and potentially tif_luv.c.
Some demonstration exploit TIFFs are available at:
http://scary.beasts.org/misc/bad_next.tiff
http://scary.beasts.org/misc/bad_thunder.tiff
The original advisory is available at:
http://scary.beasts.org/security/CESA-2004-006.txt
|
Impact:
A remote user can create TIFF files that, when loaded by the target library, will execute arbitrary code.
|
Solution:
Red Hat has released a fix.
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/libtiff-3.5.5-17.src.rpm
81fdc07747655ddf15df50f3e091bd88 libtiff-3.5.5-17.src.rpm
i386:
3c3cfb6ea1d426f7dfaf3eba049b01fa libtiff-3.5.5-17.i386.rpm
bed65897ba0f56dd646cfe108d16ec53 libtiff-devel-3.5.5-17.i386.rpm
ia64:
2dd106332e7f94e7c1b68a259b697527 libtiff-3.5.5-17.ia64.rpm
f55c05ad31942a5c55e05afc3f1cffac libtiff-devel-3.5.5-17.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/libtiff-3.5.5-17.src.rpm
81fdc07747655ddf15df50f3e091bd88 libtiff-3.5.5-17.src.rpm
ia64:
2dd106332e7f94e7c1b68a259b697527 libtiff-3.5.5-17.ia64.rpm
f55c05ad31942a5c55e05afc3f1cffac libtiff-devel-3.5.5-17.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/libtiff-3.5.5-17.src.rpm
81fdc07747655ddf15df50f3e091bd88 libtiff-3.5.5-17.src.rpm
i386:
3c3cfb6ea1d426f7dfaf3eba049b01fa libtiff-3.5.5-17.i386.rpm
bed65897ba0f56dd646cfe108d16ec53 libtiff-devel-3.5.5-17.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/libtiff-3.5.5-17.src.rpm
81fdc07747655ddf15df50f3e091bd88 libtiff-3.5.5-17.src.rpm
i386:
3c3cfb6ea1d426f7dfaf3eba049b01fa libtiff-3.5.5-17.i386.rpm
bed65897ba0f56dd646cfe108d16ec53 libtiff-devel-3.5.5-17.i386.rpm
Red Hat Enterprise Linux AS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/libtiff-3.5.7-20.1.src.rpm
63d28c10b3bd0c697395b236c675fc79 libtiff-3.5.7-20.1.src.rpm
i386:
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
41d907de858669e84d1a2c9bad3c5051 libtiff-devel-3.5.7-20.1.i386.rpm
ia64:
223bd77614b274ea88e82cc2b7179fc5 libtiff-3.5.7-20.1.ia64.rpm
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
f28363290fa144bdc459ff3804cdf5aa libtiff-devel-3.5.7-20.1.ia64.rpm
ppc:
10659dd13f97307f8066a4807f941264 libtiff-3.5.7-20.1.ppc.rpm
b439935cb94f59e804e51ec43bf1f990 libtiff-3.5.7-20.1.ppc64.rpm
baf93839e20c42f0a60690a19eabd883 libtiff-devel-3.5.7-20.1.ppc.rpm
s390:
1455a42e3976cae523bf87e3708ff35e libtiff-3.5.7-20.1.s390.rpm
8a4ba4c7c08f3c7774b1596ff10ba15a libtiff-devel-3.5.7-20.1.s390.rpm
s390x:
a3be3779774c347e96d761cbd97ff898 libtiff-3.5.7-20.1.s390x.rpm
1455a42e3976cae523bf87e3708ff35e libtiff-3.5.7-20.1.s390.rpm
bc686fba5bea3978cdfaa99134615e77 libtiff-devel-3.5.7-20.1.s390x.rpm
x86_64:
47246fe4da56c5bd5c75c35a50d7ad7c libtiff-3.5.7-20.1.x86_64.rpm
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
51458cc4571eff6f68fa528b19acbd68 libtiff-devel-3.5.7-20.1.x86_64.rpm
Red Hat Desktop version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/libtiff-3.5.7-20.1.src.rpm
63d28c10b3bd0c697395b236c675fc79 libtiff-3.5.7-20.1.src.rpm
i386:
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
41d907de858669e84d1a2c9bad3c5051 libtiff-devel-3.5.7-20.1.i386.rpm
x86_64:
47246fe4da56c5bd5c75c35a50d7ad7c libtiff-3.5.7-20.1.x86_64.rpm
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
51458cc4571eff6f68fa528b19acbd68 libtiff-devel-3.5.7-20.1.x86_64.rpm
Red Hat Enterprise Linux ES version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/libtiff-3.5.7-20.1.src.rpm
63d28c10b3bd0c697395b236c675fc79 libtiff-3.5.7-20.1.src.rpm
i386:
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
41d907de858669e84d1a2c9bad3c5051 libtiff-devel-3.5.7-20.1.i386.rpm
ia64:
223bd77614b274ea88e82cc2b7179fc5 libtiff-3.5.7-20.1.ia64.rpm
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
f28363290fa144bdc459ff3804cdf5aa libtiff-devel-3.5.7-20.1.ia64.rpm
x86_64:
47246fe4da56c5bd5c75c35a50d7ad7c libtiff-3.5.7-20.1.x86_64.rpm
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
51458cc4571eff6f68fa528b19acbd68 libtiff-devel-3.5.7-20.1.x86_64.rpm
Red Hat Enterprise Linux WS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/libtiff-3.5.7-20.1.src.rpm
63d28c10b3bd0c697395b236c675fc79 libtiff-3.5.7-20.1.src.rpm
i386:
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
41d907de858669e84d1a2c9bad3c5051 libtiff-devel-3.5.7-20.1.i386.rpm
ia64:
223bd77614b274ea88e82cc2b7179fc5 libtiff-3.5.7-20.1.ia64.rpm
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
f28363290fa144bdc459ff3804cdf5aa libtiff-devel-3.5.7-20.1.ia64.rpm
x86_64:
47246fe4da56c5bd5c75c35a50d7ad7c libtiff-3.5.7-20.1.x86_64.rpm
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
51458cc4571eff6f68fa528b19acbd68 libtiff-devel-3.5.7-20.1.x86_64.rpm
|
Vendor URL: www.libtiff.org/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Linux (Red Hat Enterprise)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Fri, 22 Oct 2004 11:14 -0400
Subject: [RHSA-2004:577-01] Updated libtiff packages
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated libtiff packages
Advisory ID: RHSA-2004:577-01
Issue date: 2004-10-22
Updated on: 2004-10-22
Product: Red Hat Enterprise Linux
CVE Names: CAN-2004-0803 CAN-2004-0886 CAN-2004-0804
- ---------------------------------------------------------------------
1. Summary:
Updated libtiff packages that fix various buffer and integer overflows are
now available.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
3. Problem description:
The libtiff package contains a library of functions for manipulating TIFF
(Tagged Image File Format) image format files. TIFF is a widely used file
format for bitmapped images.
During a source code audit, Chris Evans discovered a number of integer
overflow bugs that affect libtiff. An attacker who has the ability to trick
a user into opening a malicious TIFF file could cause the application
linked to libtiff to crash or possibly execute arbitrary code. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
names CAN-2004-0886 and CAN-2004-0804 to these issues.
Additionally, a number of buffer overflow bugs that affect libtiff have
been found. An attacker who has the ability to trick a user into opening a
malicious TIFF file could cause the application linked to libtiff to crash
or possibly execute arbitrary code. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2004-0803 to
this issue.
All users are advised to upgrade to these errata packages, which contain
fixes for these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/ for more info):
134847 - CAN-2004-0803 buffer overflows in libtiff
134850 - CAN-2004-0886 multiple integer overflows in libtiff
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/libtiff-3.5.5-17.src.rpm
81fdc07747655ddf15df50f3e091bd88 libtiff-3.5.5-17.src.rpm
i386:
3c3cfb6ea1d426f7dfaf3eba049b01fa libtiff-3.5.5-17.i386.rpm
bed65897ba0f56dd646cfe108d16ec53 libtiff-devel-3.5.5-17.i386.rpm
ia64:
2dd106332e7f94e7c1b68a259b697527 libtiff-3.5.5-17.ia64.rpm
f55c05ad31942a5c55e05afc3f1cffac libtiff-devel-3.5.5-17.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/libtiff-3.5.5-17.src.rpm
81fdc07747655ddf15df50f3e091bd88 libtiff-3.5.5-17.src.rpm
ia64:
2dd106332e7f94e7c1b68a259b697527 libtiff-3.5.5-17.ia64.rpm
f55c05ad31942a5c55e05afc3f1cffac libtiff-devel-3.5.5-17.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/libtiff-3.5.5-17.src.rpm
81fdc07747655ddf15df50f3e091bd88 libtiff-3.5.5-17.src.rpm
i386:
3c3cfb6ea1d426f7dfaf3eba049b01fa libtiff-3.5.5-17.i386.rpm
bed65897ba0f56dd646cfe108d16ec53 libtiff-devel-3.5.5-17.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/libtiff-3.5.5-17.src.rpm
81fdc07747655ddf15df50f3e091bd88 libtiff-3.5.5-17.src.rpm
i386:
3c3cfb6ea1d426f7dfaf3eba049b01fa libtiff-3.5.5-17.i386.rpm
bed65897ba0f56dd646cfe108d16ec53 libtiff-devel-3.5.5-17.i386.rpm
Red Hat Enterprise Linux AS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/libtiff-3.5.7-20.1.src.rpm
63d28c10b3bd0c697395b236c675fc79 libtiff-3.5.7-20.1.src.rpm
i386:
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
41d907de858669e84d1a2c9bad3c5051 libtiff-devel-3.5.7-20.1.i386.rpm
ia64:
223bd77614b274ea88e82cc2b7179fc5 libtiff-3.5.7-20.1.ia64.rpm
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
f28363290fa144bdc459ff3804cdf5aa libtiff-devel-3.5.7-20.1.ia64.rpm
ppc:
10659dd13f97307f8066a4807f941264 libtiff-3.5.7-20.1.ppc.rpm
b439935cb94f59e804e51ec43bf1f990 libtiff-3.5.7-20.1.ppc64.rpm
baf93839e20c42f0a60690a19eabd883 libtiff-devel-3.5.7-20.1.ppc.rpm
s390:
1455a42e3976cae523bf87e3708ff35e libtiff-3.5.7-20.1.s390.rpm
8a4ba4c7c08f3c7774b1596ff10ba15a libtiff-devel-3.5.7-20.1.s390.rpm
s390x:
a3be3779774c347e96d761cbd97ff898 libtiff-3.5.7-20.1.s390x.rpm
1455a42e3976cae523bf87e3708ff35e libtiff-3.5.7-20.1.s390.rpm
bc686fba5bea3978cdfaa99134615e77 libtiff-devel-3.5.7-20.1.s390x.rpm
x86_64:
47246fe4da56c5bd5c75c35a50d7ad7c libtiff-3.5.7-20.1.x86_64.rpm
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
51458cc4571eff6f68fa528b19acbd68 libtiff-devel-3.5.7-20.1.x86_64.rpm
Red Hat Desktop version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/libtiff-3.5.7-20.1.src.rpm
63d28c10b3bd0c697395b236c675fc79 libtiff-3.5.7-20.1.src.rpm
i386:
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
41d907de858669e84d1a2c9bad3c5051 libtiff-devel-3.5.7-20.1.i386.rpm
x86_64:
47246fe4da56c5bd5c75c35a50d7ad7c libtiff-3.5.7-20.1.x86_64.rpm
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
51458cc4571eff6f68fa528b19acbd68 libtiff-devel-3.5.7-20.1.x86_64.rpm
Red Hat Enterprise Linux ES version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/libtiff-3.5.7-20.1.src.rpm
63d28c10b3bd0c697395b236c675fc79 libtiff-3.5.7-20.1.src.rpm
i386:
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
41d907de858669e84d1a2c9bad3c5051 libtiff-devel-3.5.7-20.1.i386.rpm
ia64:
223bd77614b274ea88e82cc2b7179fc5 libtiff-3.5.7-20.1.ia64.rpm
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
f28363290fa144bdc459ff3804cdf5aa libtiff-devel-3.5.7-20.1.ia64.rpm
x86_64:
47246fe4da56c5bd5c75c35a50d7ad7c libtiff-3.5.7-20.1.x86_64.rpm
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
51458cc4571eff6f68fa528b19acbd68 libtiff-devel-3.5.7-20.1.x86_64.rpm
Red Hat Enterprise Linux WS version 3:
SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/libtiff-3.5.7-20.1.src.rpm
63d28c10b3bd0c697395b236c675fc79 libtiff-3.5.7-20.1.src.rpm
i386:
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
41d907de858669e84d1a2c9bad3c5051 libtiff-devel-3.5.7-20.1.i386.rpm
ia64:
223bd77614b274ea88e82cc2b7179fc5 libtiff-3.5.7-20.1.ia64.rpm
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
f28363290fa144bdc459ff3804cdf5aa libtiff-devel-3.5.7-20.1.ia64.rpm
x86_64:
47246fe4da56c5bd5c75c35a50d7ad7c libtiff-3.5.7-20.1.x86_64.rpm
818848dcbf461a6f37790579d8c80f0f libtiff-3.5.7-20.1.i386.rpm
51458cc4571eff6f68fa528b19acbd68 libtiff-devel-3.5.7-20.1.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key.html#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0803
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0886
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0804
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact.html
Copyright 2004 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQFBeSOyXlSAg2UNWIIRAmEZAJ9zoy5yAHcQaN702g07b68BnKTVKQCfXtU/
XAstdvkT337/IlEh6vd4RGA=
=P/Az
-----END PGP SIGNATURE-----
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
|
|
Go to the Top of This SecurityTracker Archive Page
|
