Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 8 Apr 2016 07:13:29 +0000
From: 张开翔 <zhangkaixiang@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2016-3633 - libtiff 4.0.6 illegel read

Details

=======



Product: libtiff

Affected Versions: <= 4.0.6

Vulnerability Type: Illegel read

Vendor URL: http://www.libtiff.org/

CVE ID: CVE-2016-3633

Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360



Introduction

Illegal read occurs in the _ setrow function in thumbnail.c when using thumbnail command, which allows attackers to exploit this issue to cause denial-of-service.


/libtiff/tools/thumbnail.c:525
523  for (y = 0; y < nrows; y++) {
524      const uint8* src = rows[y] + off;
525      acc += bits[*src++ & mask0];

gdb  --args  thumbnail  setrow.tif  tmpout.tif
……
Program received signal SIGSEGV, Segmentation fault.
0x08049de5 in setrow (row=0x8061d00 "", nrows=256, rows=0xbfffeba0) at thumbnail.c:525
525                acc += bits[*src++ & mask0];
(gdb) bt
#0  0x08049de5 in setrow (row=0x8061d00 "", nrows=256, rows=0xbfffeba0) at thumbnail.c:525
#1  0x0804a07a in setImage1 (br=0x804d9b8 "\377", rw=5242880, rh=5242880) at thumbnail.c:581
#2  0x0804a121 in setImage (br=0x804d9b8 "\377", rw=5242880, rh=5242880) at thumbnail.c:591
#3  0x0804a2db in generateThumbnail (in=0x804d530, out=0x804d008) at thumbnail.c:633
#4  0x08048f5f in main (argc=3, argv=0xbffff134) at thumbnail.c:122
(gdb) p *src
Cannot access memory at address 0x8204988

References:
[1] http://www.remotesensing.org/libtiff/
[2] http://bugzilla.maptools.org/buglist.cgi?product=libtiff


Thank you!

Best Regards,

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.