Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 8 Apr 2016 07:16:12 +0000
From: 张开翔 <zhangkaixiang@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2016-3658 - libtiff 4.0.6 illegel read

Details

=======



Product: libtiff

Affected Versions: <= 4.0.6

Vulnerability Type: Illegel read

Vendor URL: http://www.remotesensing.org/libtiff/

CVE ID: CVE-2016-3658

Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360



Introduction

Illegal read occurs in the TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c when using tiffset command, which allows attackers to exploit this issue to cause denial-of-service.



/libtiff/tif_dirwrite.c: 1625
1623    for (q=p, ma=value, mb=0; mb<count; ma++, mb++, q++)
1624    {
1625        if (*ma>0xFFFFFFFF)
1626        {
1627            TIFFErrorExt(tif->tif_clientdata,module,
1628                         "Attempt to write value larger than 0xFFFFFFFF in Classic TIFF file.");
1629            _TIFFfree(p);
1630            return(0);
1631        }
1632        *q= (uint32)(*ma);
1633       }


gdb --args ./tiffset -s 300 296 poc.tif
……
Program received signal SIGSEGV, Segmentation fault.
TIFFWriteDirectoryTagLongLong8Array (tif=0x606010, ndir=0x7fffffffe1f0, dir=0x606560, tag=<optimized out>, count=1, value=0x0) at tif_dirwrite.c:1625
1625                 if (*ma>0xFFFFFFFF)
(gdb) bt
#0  TIFFWriteDirectoryTagLongLong8Array (tif=0x606010, ndir=0x7fffffffe1f0, dir=0x606560, tag=<optimized out>, count=1, value=0x0) at tif_dirwrite.c:1625
#1  0x00007ffff7abd867 in TIFFWriteDirectorySec (tif=0x606010, isimage=1, imagedone=1, pdiroff=0x0) at tif_dirwrite.c:550
#2  0x00007ffff7ad302c in TIFFRewriteDirectory (tif=tif@...ry=0x606010) at tif_dirwrite.c:359
#3  0x0000000000401a70 in main (argc=5, argv=<optimized out>) at tiffset.c:344
(gdb) l
1620                 return(0);
1621             }
1622
1623             for (q=p, ma=value, mb=0; mb<count; ma++, mb++, q++)
1624             {
1625                 if (*ma>0xFFFFFFFF)
1626                 {
1627                     TIFFErrorExt(tif->tif_clientdata,module,
1628                                  "Attempt to write value larger than 0xFFFFFFFF in Classic TIFF file.");
1629                     _TIFFfree(p);
(gdb) p ma
$1 = (uint64 *) 0x0

References:
[1] http://www.remotesensing.org/libtiff/


Thank you!

Best Regards,

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.