Bugzilla – Bug 974840
VUL-1: CVE-2016-3658: tiff: Illegal read in TIFFWriteDirectoryTagLongLong8Array function in tiffset / tif_dirwrite.c
Last modified: 2017-01-08 00:18:20 UTC
Details ======= Product: libtiff Affected Versions: <= 4.0.6 Vulnerability Type: Illegel read Vendor URL: http://www.remotesensing.org/libtiff/ CVE ID: CVE-2016-3658 Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360 Introduction Illegal read occurs in the TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c when using tiffset command, which allows attackers to exploit this issue to cause denial-of-service. /libtiff/tif_dirwrite.c: 1625 1623 for (q=p, ma=value, mb=0; mb<count; ma++, mb++, q++) 1624 { 1625 if (*ma>0xFFFFFFFF) 1626 { 1627 TIFFErrorExt(tif->tif_clientdata,module, 1628 "Attempt to write value larger than 0xFFFFFFFF in Classic TIFF file."); 1629 _TIFFfree(p); 1630 return(0); 1631 } 1632 *q= (uint32)(*ma); 1633 } gdb --args ./tiffset -s 300 296 poc.tif ���� Program received signal SIGSEGV, Segmentation fault. TIFFWriteDirectoryTagLongLong8Array (tif=0x606010, ndir=0x7fffffffe1f0, dir=0x606560, tag=<optimized out>, count=1, value=0x0) at tif_dirwrite.c:1625 1625 if (*ma>0xFFFFFFFF) (gdb) bt #0 TIFFWriteDirectoryTagLongLong8Array (tif=0x606010, ndir=0x7fffffffe1f0, dir=0x606560, tag=<optimized out>, count=1, value=0x0) at tif_dirwrite.c:1625 #1 0x00007ffff7abd867 in TIFFWriteDirectorySec (tif=0x606010, isimage=1, imagedone=1, pdiroff=0x0) at tif_dirwrite.c:550 #2 0x00007ffff7ad302c in TIFFRewriteDirectory (tif=tif@...ry=0x606010) at tif_dirwrite.c:359 #3 0x0000000000401a70 in main (argc=5, argv=<optimized out>) at tiffset.c:344 (gdb) l 1620 return(0); 1621 } 1622 1623 for (q=p, ma=value, mb=0; mb<count; ma++, mb++, q++) 1624 { 1625 if (*ma>0xFFFFFFFF) 1626 { 1627 TIFFErrorExt(tif->tif_clientdata,module, 1628 "Attempt to write value larger than 0xFFFFFFFF in Classic TIFF file."); 1629 _TIFFfree(p); (gdb) p ma $1 = (uint64 *) 0x0 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3658 http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-3658.html http://www.openwall.com/lists/oss-security/2016/04/08/12
bugbot adjusting priority
It looks like only SLE-12 and openSUSE Leap is affected by this. The function TIFFWriteDirectoryTagLongLong8Array does not exist in version 3.8.2. There is only a TIFFWriteDirectory function inside libtiff/tif_dirwrite.c.
It looks like upstream marked this as duplicate. (reproducers available) http://bugzilla.maptools.org/show_bug.cgi?id=2500 Upstream Fix: https://github.com/vadz/libtiff/commit/45c68450bef8ad876f310b495165c513cad8b67d
openSUSE-SU-2016:3035-1: An update that fixes 14 vulnerabilities is now available. Category: security (important) Bug References: 1007280,1010161,1010163,1011103,1011107,914890,974449,974840,984813,984815,987351 CVE References: CVE-2014-8127,CVE-2015-7554,CVE-2015-8665,CVE-2015-8683,CVE-2016-3622,CVE-2016-3658,CVE-2016-5321,CVE-2016-5323,CVE-2016-5652,CVE-2016-5875,CVE-2016-9273,CVE-2016-9297,CVE-2016-9448,CVE-2016-9453 Sources used: openSUSE 13.2 (src): tiff-4.0.7-10.35.1
SUSE-SU-2016:3301-1: An update that fixes 11 vulnerabilities is now available. Category: security (moderate) Bug References: 1007280,1010161,1010163,1011103,1011107,914890,974449,974840,984813,984815,987351 CVE References: CVE-2014-8127,CVE-2016-3622,CVE-2016-3658,CVE-2016-5321,CVE-2016-5323,CVE-2016-5652,CVE-2016-5875,CVE-2016-9273,CVE-2016-9297,CVE-2016-9448,CVE-2016-9453 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP2 (src): tiff-4.0.7-35.1 SUSE Linux Enterprise Software Development Kit 12-SP1 (src): tiff-4.0.7-35.1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): tiff-4.0.7-35.1 SUSE Linux Enterprise Server 12-SP2 (src): tiff-4.0.7-35.1 SUSE Linux Enterprise Server 12-SP1 (src): tiff-4.0.7-35.1 SUSE Linux Enterprise Desktop 12-SP2 (src): tiff-4.0.7-35.1 SUSE Linux Enterprise Desktop 12-SP1 (src): tiff-4.0.7-35.1
release for openSUSE, all done
openSUSE-SU-2017:0074-1: An update that fixes 11 vulnerabilities is now available. Category: security (moderate) Bug References: 1007280,1010161,1010163,1011103,1011107,914890,974449,974840,984813,984815,987351 CVE References: CVE-2014-8127,CVE-2016-3622,CVE-2016-3658,CVE-2016-5321,CVE-2016-5323,CVE-2016-5652,CVE-2016-5875,CVE-2016-9273,CVE-2016-9297,CVE-2016-9448,CVE-2016-9453 Sources used: openSUSE Leap 42.2 (src): tiff-4.0.7-12.1 openSUSE Leap 42.1 (src): tiff-4.0.7-12.1