Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 15 Jun 2016 02:36:19 +0000
From: 张开翔 <zhangkaixiang@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2016-5322:libtiff 4.0.6 extractContigSamplesBytes:
  out-of-bounds read

Details
=======

Product: libtiff
Affected Versions: <= 4.0.6
Vulnerability Type: illegel read
Vendor URL: http://www.remotesensing.org/libtiff/
Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360
CVE ID: CVE-2016-5322
Tested system version:
       fedora23 32bit
       fedora23 64bit
       CentOS Linux release 7.1.1503 64bit

Introduction
=======

It was always corrupted when I use tiffcrop command followed by a crafted TIFF image .The vulnerbility exists in extractContigSamplesBytes() without checking the buffer length when reading, Attackers could exploit this issue to cause denial-of-service.

Here is the stack info:
gdb –args ./tiffcrop extractContigSamplesBytes.tif tmpout.tif
--- ---
Program received signal SIGSEGV, Segmentation fault.
extractContigSamplesBytes (in=0x6647b0 "@...35\367\377\177", out=out@...ry=0x66d9a0 "@...35\367\377\177", cols=cols@...ry=32, sample=sample@...ry=0, spp=spp@...ry=16385, bps=bps@...ry=256, count=count@...ry=1, start=1, start@...ry=0,
    end=end@...ry=32) at tiffcrop.c:2705
2705                     *dst++ = *src++;
(gdb) bt
#0  extractContigSamplesBytes (in=0x6647b0 "@...35\367\377\177", out=out@...ry=0x66d9a0 "@...35\367\377\177", cols=cols@...ry=32, sample=sample@...ry=0, spp=spp@...ry=16385, bps=bps@...ry=256, count=count@...ry=1, start=1,
    start@...ry=0, end=end@...ry=32) at tiffcrop.c:2705
#1  0x00000000004379a7 in extractContigSamplesToBuffer (dump=<optimized out>, bps=256, spp=16385, sample=0, cols=<optimized out>, rows=<optimized out>, in=0x6647b0 "@...35\367\377\177", out=0x66d9a0 "@...35\367\377\177")
    at tiffcrop.c:3493
#2  writeBufferToSeparateStrips (out=out@...ry=0x662570, buf=buf@...ry=0x6647b0 "@...35\367\377\177", length=length@...ry=32, width=width@...ry=32, spp=spp@...ry=16385, dump=dump@...ry=0x7fffffffc260) at tiffcrop.c:1165
#3  0x000000000043e729 in writeCroppedImage (in=in@...ry=0x662010, out=0x662570, image=image@...ry=0x7fffffff7950, dump=dump@...ry=0x7fffffffc260, width=32, length=32, crop_buff=crop_buff@...ry=0x6647b0 "@...35\367\377\177",
    pagenum=pagenum@...ry=0, total_pages=total_pages@...ry=1) at tiffcrop.c:7866
#4  0x0000000000408acb in main (argc=<optimized out>, argv=<optimized out>) at tiffcrop.c:2326
(gdb) p src
$4 = (uint8 *) 0x6e47d0 <Address 0x6e47d0 out of bounds>


Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ