(Apple Issues Fix for AppKit) LibTIFF Buffer Overflows May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1012402 |
|
SecurityTracker URL: http://securitytracker.com/id/1012402
|
|
CVE Reference:
CAN-2004-0803
(Links to External Site)
|
Date: Dec 2 2004
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
Some buffer overflow vulnerabilities were reported in LibTIFF. A remote user may be able to execute arbitrary code on the target user's system. Apple's AppKit is affected.
Gentoo reported that a remote user may be able to create a specially crafted image file that, when processed by the library, will execute arbitrary code with the privileges of the target user.
Chris Evans is credited with discovering these flaws.
The flaws reside in the RLE decoding routines in tif_next.c, tif_thunder.c, and potentially tif_luv.c.
Some demonstration exploit TIFFs are available at:
http://scary.beasts.org/misc/bad_next.tiff
http://scary.beasts.org/misc/bad_thunder.tiff
The original advisory is available at:
http://scary.beasts.org/security/CESA-2004-006.txt
|
Impact:
A remote user can create TIFF files that, when loaded by the target library, will execute arbitrary code.
|
Solution:
Apple has issued a fix for AppKit (which is affected by the libtiff vulnerability) as part of Security Update 2004-12-02, available at:
- Software Update preferences
- Apple Downloads:
http://www.apple.com/swupdates/
|
Vendor URL: www.apple.com/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
UNIX (OS X)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 2 Dec 2004 16:38:53 -0500
Subject: [none]
|
Security Update 2004-12-02
Appkit
Available for: Mac OS X v10.3.6, Mac OS X Server v10.3.6, Mac OS X v10.2.8, Mac OS X Server v10.2.8
CVE-ID: CAN-2004-1081
Impact: Characters entered into a secure text field can be read by other applications
in the same window session
Description: In some circumstances a secure text input field will not correctly enable
secure input. This can allow other applications in the same window session to see some
input characters and keyboard events. Input to secure text fields is now enabled in a
way to prevent the leakage of key press information.
Appkit
Available for: Mac OS X v10.3.6, Mac OS X Server v10.3.6, Mac OS X v10.2.8, Mac OS X Server v10.2.8
CVE-ID: CAN-2004-0803, CAN-2004-0804, CAN-2004-0886
Impact: Integer overflows and poor range checking in tiff handling could allow to
execution of arbitrary code or denial of service.
Description: Flaws in decoding tiff images could overwrite memory, cause arithmetic
errors resulting in a crash, or permit the execution of arbitrary code. This update
corrects the problems in the handling of tiff images.
|
|
