Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 18 Jul 2016 10:38:22 -0700
From: akuster <akuster@...sta.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2016-5321: libtiff 4.0.6 DumpModeDecode():
 Ddos


Hello,

If I am not mistaken, this maybe the fix for this CVE.

https://github.com/vadz/libtiff/commit/d9783e4a1476b6787a51c5ae9e9b3156527589f0

can someone confirm

regards,
Armin

On 06/14/2016 07:35 PM, 张开翔 wrote:
> Details
> =======
> 
> Product: libtiff
> Affected Versions: <= 4.0.6
> Vulnerability Type: illegel read
> Vendor URL: http://www.remotesensing.org/libtiff/
> Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360
> CVE ID: CVE-2016-5321
> Tested system version:
>        fedora23 32bit
>        fedora23 64bit
>        CentOS Linux release 7.1.1503 64bit
> 
> 
> Introduction
> =======
> 
> It was always corrupted when I use tiffcrop command followed by a crafted TIFF image.The vulnerbility exists in fuction DumpModeDecode() whitout checking the value of output parameters, Attackers could exploit this issue to cause denial-of-service.
> 
> 
> Here is the stack info:
> gdb –args ./tiffcrop DumpModeDecode.tif tmpout.tif
> --- ---
> __memcpy_ssse3_back () at ../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:2709
> 2709                   movdqu    %xmm0, 36(%rdi)
> Program received signal SIGSEGV, Segmentation fault.
> __memcpy_ssse3_back () at ../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:2709
> 2709                   movdqu    %xmm0, 36(%rdi)
> (gdb) bt
> #0  __memcpy_ssse3_back () at ../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:2709
> #1  0x00007ffff7ad6a79 in DumpModeDecode (tif=0x662010, buf=<optimized out>, cc=52, s=<optimized out>) at tif_dumpmode.c:103
> #2  0x00007ffff7ba3739 in TIFFReadEncodedTile (tif=tif@...ry=0x662010, tile=8, buf=0x0, size=52, size@...ry=-1) at tif_read.c:668
> #3  0x00007ffff7ba3a01 in TIFFReadTile (tif=tif@...ry=0x662010, buf=<optimized out>, x=x@...ry=0, y=y@...ry=0, z=z@...ry=0, s=s@...ry=8) at tif_read.c:641
> #4  0x0000000000443e41 in readSeparateTilesIntoBuffer (bps=208, spp=9, tl=1, tw=2, imagewidth=2, imagelength=1, obuf=0x662ce0 "\200\177\335\367\377\177", in=0x662010) at tiffcrop.c:994
> #5  loadImage (in=in@...ry=0x662010, image=image@...ry=0x7fffffff7960, dump=dump@...ry=0x7fffffffc270, read_ptr=read_ptr@...ry=0x7fffffff7920) at tiffcrop.c:6079
> #6  0x0000000000403209 in main (argc=<optimized out>, argv=<optimized out>) at tiffcrop.c:2278
> (gdb) p buf
> $6 = 0x0
> 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.