(Conectiva Issues Fix) LibTIFF Buffer Overflows May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1012124 |
|
SecurityTracker URL: http://securitytracker.com/id/1012124
|
|
CVE Reference:
CAN-2004-0803
(Links to External Site)
|
Date: Nov 8 2004
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 3.6.1
|
Description:
Some buffer overflow vulnerabilities were reported in LibTIFF. A remote user may be able to execute arbitrary code on the target user's system.
Gentoo reported that a remote user may be able to create a specially crafted image file that, when processed by the library, will execute arbitrary code with the privileges of the target user.
Chris Evans is credited with discovering these flaws.
The flaws reside in the RLE decoding routines in tif_next.c, tif_thunder.c, and potentially tif_luv.c.
Some demonstration exploit TIFFs are available at:
http://scary.beasts.org/misc/bad_next.tiff
http://scary.beasts.org/misc/bad_thunder.tiff
The original advisory is available at:
http://scary.beasts.org/security/CESA-2004-006.txt
|
Impact:
A remote user can create TIFF files that, when loaded by the target library, will execute arbitrary code.
|
Solution:
Conectiva has released a fix.
ftp://atualizacoes.conectiva.com.br/10/SRPMS/libtiff3-3.5.7-53035U10_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libtiff-devel-3.5.7-53035U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libtiff-devel-static-3.5.7-53035U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libtiff-progs-3.5.7-53035U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libtiff3-3.5.7-53035U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/libtiff3-3.5.7-8492U90_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libtiff-devel-3.5.7-8492U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libtiff-devel-static-3.5.7-8492U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libtiff-progs-3.5.7-8492U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libtiff3-3.5.7-8492U90_1cl.i386.rpm
|
Vendor URL: www.libtiff.org/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Linux (Conectiva)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Mon, 8 Nov 2004 11:20:33 -0200
Subject: [Conectiva-updates] [CLA-2004:888] Conectiva Security Announcement
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------
PACKAGE : libtiff3
SUMMARY : Fixes for libtiff vulnerabilities
DATE : 2004-11-08 11:19:00
ID : CLA-2004:888
RELEVANT
RELEASES : 9, 10
- -------------------------------------------------------------------------
DESCRIPTION
libtiff[1] is a library for handling TIFF images.
This announcement fixes several integer overflow vulnerabilities that
were encountered in libtiff.
The fixed vulnerabilities are:
CAN-2004-0803: Chris Evans encountered several problems in the RLE
(Run Length Encoding) decoders that could lead to an arbitrary code
execution vulnerability through a specially crafted image.
CAN-2004-0804: Matthias Clasen encountered a division by zero through
an integer overflow that could lead to a denial of service
vulnerability which could be triggered by a specially crafted image.
CAN-2004-0886: Dmitry V. Levin encountered several integer overflows
that caused malloc issues which could result in either plain a crash
or memory corruption.
SOLUTION
It is recommended that all libtiff users upgrade their packages.
IMPORTANT: all applications linked against libff must be restarted
after the upgrade in order to close the vulnerabilities.
REFERENCES
1.http://www.libtiff.org
2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0803
3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0804
4.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0886
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/10/SRPMS/libtiff3-3.5.7-53035U10_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libtiff-devel-3.5.7-53035U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libtiff-devel-static-3.5.7-53035U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libtiff-progs-3.5.7-53035U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libtiff3-3.5.7-53035U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/libtiff3-3.5.7-8492U90_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libtiff-devel-3.5.7-8492U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libtiff-devel-static-3.5.7-8492U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libtiff-progs-3.5.7-8492U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libtiff3-3.5.7-8492U90_1cl.i386.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions regarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
Copyright (c) 2004 Conectiva Inc.
http://www.conectiva.com
- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQFBj3Kg42jd0JmAcZARAgDUAKDkHA0wDki3F8kphf1lJ+KK9mLSKwCg8oXX
Xzc3LeuVQZJlhQQw0Fn2gXw=
=zInc
-----END PGP SIGNATURE-----
______________________________________________________________________
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
|
|
