Bugzilla – Bug 444079
VUL-0: CVE-2008-1586: TIFF memory use denial-of-service
Last modified: 2022-06-08 13:17:28 UTC
From: Geoff Keating <geoffk@apple.com> To: vendor-sec@lst.de Date: Tue, 11 Nov 2008 16:00:38 -0800 Cc: Frank Warmerdam <warmerdam@pobox.com>, Andrey Kiselev <dron@ak4719.spb.edu> We've found that a memory exhaustion issue exists in the handling of TIFF images. Viewing a maliciously crafted TIFF image may lead to memory exhaustion, which on iPhone causes a kernel watchdog timeout and then a device reset. We plan to fix the issue on iPhone by limiting the amount of memory that can be allocated as part of opening a TIFF image. The issue here is that when a TIFF file specifies a huge number of strips or tiles, the TIFF reader will allocate space for all of those strips, even if there isn't that much memory available. It will do this even if the file isn't anywhere close to being big enough to actually have all those strips. This occurs on all platforms. We have assigned this issue, as it applies to iPhone, CVE-2008-1586. We will credit Sergio Alvarez for reporting this issue. I wrote a simple example that demonstrates this with stock libTIFF (but not if you just open it on iPhone), which I attach as CVE-2008-1586.zip.
Created attachment 251527 [details] the attachment from the mail
The test image causes an endless loop. This patch fixes it. I did not notice any other problem. Max. size of a tiff image is 4GB. Today machines should handle this so I don't think there should be any further limitation. --- libtiff/tif_dirread.c +++ libtiff/tif_dirread.c @@ -870,7 +870,7 @@ register TIFFDirEntry *dp; register TIFFDirectory *td = &tif->tif_dir; - uint16 i; + uint32 i; if (td->td_stripbytecount) _TIFFfree(td->td_stripbytecount);
ping. which dists need updates, or will STABLE suffice?
Sorry for the delay. The bug is present in libtiff 3.8.2 which is in 10.3 - 11.1 The older libtiff versions on SLES9 and 10 handle the image correctly (as a very large image that is truncated)
The SWAMPID for this issue is 22388. Please submit the patch and patchinfo file using this ID. (https://swamp.suse.de/webswamp/wf/22388)
submitted for 10.3 - 11.1 and sle11
the crd in swamp was wrong. it actually is already public
Update released for: libtiff-devel, libtiff3, tiff Products: openSUSE 10.3 (i386, ppc, ppc64, x86_64) openSUSE 11.0 (debug, i386, ppc, ppc64, x86_64) openSUSE 11.1 (debug, i586, ppc, ppc64, x86_64)
CVE-2008-1586: CVSS v2 Base Score: 7.1 (AV:N/AC:M/Au:N/C:N/I:N/A:C)