Date: Tue, 29 Jun 2010 08:05:25 -0400 From: Dan Rosenberg <dan.j.rosenberg@...il.com> To: oss-security@...ts.openwall.com Cc: Tomas Hoger <thoger@...hat.com>, Josh Bressers <bressers@...hat.com>, coley <coley@...re.org> Subject: Re: CVE requests: LibTIFF On request, I'm re-posting the issues which I think actually deserve CVE ids. The following three issues reliably crash libtiff in the general case of doing initial parsing to view an image: 1. Out-of-bounds read in TIFFExtractData() may result in application crash. Revision 18.104.22.168 of libtiff/tif_dirread.c added code for ensuring valid type information for each TIFF directory entry. Prior to this fix, unknown tag types would result in an out-of-bounds array index in TIFFExtractData() on any code path using this macro. Ubuntu security backported this fix as debian/patches/fix-unknown-tags.patch because in discussion with them, I identified the patch as a fix for this issue. I discovered this issue and disclosed it to iDefense Labs along with the SubjectDistance overflow, but they did not share details of this with downstream vendors (which was the source of my confusion surrounding knowledge of the issue). It seems that it was actually fixed in 3.9.4 inadvertently as a result of fixing another unrelated problem, and my description of it here can be considered the first disclosure of the issue, which affects all versions 3.x <= 3.9.2. 2. A NULL pointer derefrence in TIFFVGetField() may result in application crash (https://bugs.launchpad.net/ubuntu/lucid/+source/tiff/+bug/589145). The fix for this issue was combined with the fix for CVE-2010-2065, but it has been confirmed to be a separate issue. Reported by Sauli Pahlman. 3. Out-of-bounds read in TIFFRGBAImageGet() due to reading past the bounds of a buffer (https://bugs.launchpad.net/ubuntu/+source/tiff/+bug/591605) may lead to application crash. Reported by Sauli Pahlman. The remainder of the issues have already been assigned CVEs or require additional user assistance to trigger, as as such can be considered stability issues rather than security. Thanks, Dan On Thu, Jun 24, 2010 at 9:38 AM, Tomas Hoger <thoger@...hat.com> wrote: > On Thu, 24 Jun 2010 09:16:20 -0400 Dan Rosenberg wrote: > >> >> 1. Out-of-bounds read in TIFFExtractData() may result in >> >> application crash (no reference, fixed upstream). Reported by Dan >> >> Rosenberg. >> > >> > Do you have any info on this? I don't see anything obviously >> > related in changelog. TIFFExtractData itself and all its uses seem >> > unchanged for years. >> >> Revision 22.214.171.124 of libtiff/tif_dirread.c added code for ensuring >> valid tag type information for each TIFF directory entry. Prior to >> this fix, unknown tag types would result in an out-of-bounds array >> index in TIFFExtractData() on any code path using this macro. Ubuntu >> security backported this fix as debian/patches/fix-unknown-tags.patch >> in their libtiff4 package. > > So the reference is: > http://bugzilla.maptools.org/show_bug.cgi?id=2210 > > -- > Tomas Hoger / Red Hat Security Response Team >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.