[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <AANLkTikPDnHtsPQuJevKoynK2_xSjc0sjyTPIvyPu6eA@mail.gmail.com>
Date: Tue, 29 Jun 2010 08:05:25 -0400
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
Cc: Tomas Hoger <thoger@...hat.com>, Josh Bressers <bressers@...hat.com>, coley <coley@...re.org>
Subject: Re: CVE requests: LibTIFF
On request, I'm re-posting the issues which I think actually deserve
CVE ids. The following three issues reliably crash libtiff in the
general case of doing initial parsing to view an image:
1. Out-of-bounds read in TIFFExtractData() may result in application
crash. Revision 1.92.2.9 of libtiff/tif_dirread.c added code for
ensuring valid type information for each TIFF directory entry. Prior
to this fix, unknown tag types would result in an out-of-bounds array
index in TIFFExtractData() on any code path using this macro.
Ubuntu security backported this fix as
debian/patches/fix-unknown-tags.patch because in discussion with them,
I identified the patch as a fix for this issue. I discovered this
issue and disclosed it to iDefense Labs along with the SubjectDistance
overflow, but they did not share details of this with downstream
vendors (which was the source of my confusion surrounding knowledge of
the issue). It seems that it was actually fixed in 3.9.4
inadvertently as a result of fixing another unrelated problem, and my
description of it here can be considered the first disclosure of the
issue, which affects all versions 3.x <= 3.9.2.
2. A NULL pointer derefrence in TIFFVGetField() may result in
application crash
(https://bugs.launchpad.net/ubuntu/lucid/+source/tiff/+bug/589145).
The fix for this issue was combined with the fix for CVE-2010-2065,
but it has been confirmed to be a separate issue. Reported by Sauli
Pahlman.
3. Out-of-bounds read in TIFFRGBAImageGet() due to reading past the
bounds of a buffer
(https://bugs.launchpad.net/ubuntu/+source/tiff/+bug/591605) may lead
to application crash. Reported by Sauli Pahlman.
The remainder of the issues have already been assigned CVEs or require
additional user assistance to trigger, as as such can be considered
stability issues rather than security.
Thanks,
Dan
On Thu, Jun 24, 2010 at 9:38 AM, Tomas Hoger <thoger@...hat.com> wrote:
> On Thu, 24 Jun 2010 09:16:20 -0400 Dan Rosenberg wrote:
>
>> >> 1. Out-of-bounds read in TIFFExtractData() may result in
>> >> application crash (no reference, fixed upstream). Reported by Dan
>> >> Rosenberg.
>> >
>> > Do you have any info on this? I don't see anything obviously
>> > related in changelog. TIFFExtractData itself and all its uses seem
>> > unchanged for years.
>>
>> Revision 1.92.2.9 of libtiff/tif_dirread.c added code for ensuring
>> valid tag type information for each TIFF directory entry. Prior to
>> this fix, unknown tag types would result in an out-of-bounds array
>> index in TIFFExtractData() on any code path using this macro. Ubuntu
>> security backported this fix as debian/patches/fix-unknown-tags.patch
>> in their libtiff4 package.
>
> So the reference is:
> http://bugzilla.maptools.org/show_bug.cgi?id=2210
>
> --
> Tomas Hoger / Red Hat Security Response Team
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
