Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <5EDB84F4B23F5B4DB6500A89258280E0B97349@EX02.corp.qihoo.net>
Date: Fri, 8 Apr 2016 07:10:54 +0000
From: 张开翔 <zhangkaixiang@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2016-3632 - libtiff 4.0.6 illegel write

Details

=======



Product: libtiff

Affected Versions: <= 4.0.6

Vulnerability Type: Illegel write

Vendor URL:  http://www.remotesensing.org/libtiff/

CVE ID: CVE-2016-3632

Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360



Introduction

Illegal write occurs in the _TIFFVGetField function in tif_dirinfo.c when using thumbnail command, which allows attackers to exploit this issue to cause denial-of-service or may command excution.



libtiff/tif_dir.c:1073
1068                                          if (fip->field_type == TIFF_ASCII
1069                                              || fip->field_readcount == TIFF_VARIABLE
1070                                              || fip->field_readcount == TIFF_VARIABLE2
1071                                              || fip->field_readcount == TIFF_SPP
1072                                              || tv->count > 1) {
1073                                                 *va_arg(ap, void **) = tv->value;
1074                                                 ret_val = 1;

gdb  --args  thumbnail  _ TIFFVGetField.tif  tmpout.tif
……
Program received signal SIGSEGV, Segmentation fault.
_TIFFVGetField (tif=<optimized out>, tag=<optimized out>, ap=<optimized out>) at tif_dir.c:1073
1073                                                                           *va_arg(ap, void **) = tv->value;
Missing separate debuginfos, use: dnf debuginfo-install glibc-2.22-10.fc23.x86_64 libjpeg-turbo-1.4.1-2.fc23.x86_64
(gdb) bt
#0  _TIFFVGetField (tif=<optimized out>, tag=<optimized out>, ap=<optimized out>) at tif_dir.c:1073
#1  0x00007ffff7a6b5e1 in TIFFGetField (tif=tif@...ry=0x60a930, tag=tag@...ry=326) at tif_dir.c:1158
#2  0x00000000004034a1 in cpTag (type=TIFF_LONG, count=<optimized out>, tag=<optimized out>, out=<optimized out>, in=<optimized out>) at thumbnail.c:167
#3  cpTags (out=<optimized out>, in=<optimized out>) at thumbnail.c:297
#4  cpIFD (out=<optimized out>, in=<optimized out>) at thumbnail.c:373
#5  main (argc=<optimized out>, argv=<optimized out>) at thumbnail.c:124
(gdb) x/xw ap-4
0xbffff2bc:        0x00000001

References:
[1] http://www.remotesensing.org/libtiff/


Thank you!

Best Regards,

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.