[<prev] [next>] [day] [month] [year] [list]
Message-ID: <5EDB84F4B23F5B4DB6500A89258280E0B97367@EX02.corp.qihoo.net>
Date: Fri, 8 Apr 2016 07:13:29 +0000
From: 张开翔 <zhangkaixiang@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2016-3633 - libtiff 4.0.6 illegel read
Details
=======
Product: libtiff
Affected Versions: <= 4.0.6
Vulnerability Type: Illegel read
Vendor URL: http://www.libtiff.org/
CVE ID: CVE-2016-3633
Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360
Introduction
Illegal read occurs in the _ setrow function in thumbnail.c when using thumbnail command, which allows attackers to exploit this issue to cause denial-of-service.
/libtiff/tools/thumbnail.c:525
523 for (y = 0; y < nrows; y++) {
524 const uint8* src = rows[y] + off;
525 acc += bits[*src++ & mask0];
gdb --args thumbnail setrow.tif tmpout.tif
……
Program received signal SIGSEGV, Segmentation fault.
0x08049de5 in setrow (row=0x8061d00 "", nrows=256, rows=0xbfffeba0) at thumbnail.c:525
525 acc += bits[*src++ & mask0];
(gdb) bt
#0 0x08049de5 in setrow (row=0x8061d00 "", nrows=256, rows=0xbfffeba0) at thumbnail.c:525
#1 0x0804a07a in setImage1 (br=0x804d9b8 "\377", rw=5242880, rh=5242880) at thumbnail.c:581
#2 0x0804a121 in setImage (br=0x804d9b8 "\377", rw=5242880, rh=5242880) at thumbnail.c:591
#3 0x0804a2db in generateThumbnail (in=0x804d530, out=0x804d008) at thumbnail.c:633
#4 0x08048f5f in main (argc=3, argv=0xbffff134) at thumbnail.c:122
(gdb) p *src
Cannot access memory at address 0x8204988
References:
[1] http://www.remotesensing.org/libtiff/
[2] http://bugzilla.maptools.org/buglist.cgi?product=libtiff
Thank you!
Best Regards,
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
