Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow.

Updated kdegraphics packages that resolve multiple security issues in kfax are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team

The kdegraphics package contains graphics applications for the K Desktop Environment.

During a source code audit, Chris Evans discovered a number of integer overflow bugs that affect libtiff. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these bugs. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0886 and CVE-2004-0804 to these issues.

Additionally, a number of buffer overflow bugs that affect libtiff have been found. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these bugs. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0803 to this issue.

Users of kfax should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue.

A buffer overflow was discovered in the TIFF library. A TIFF file includes a value indicating the number of 'directory entry' header fields contained in the file. If this value is -1, an invalid memory allocation was performed. A malicious image could be constructed which, when decoded, would have resulted in execution of arbitrary code with the privileges of the process using the library.

Since this library is used in many applications like 'ghostscript' and the 'CUPS' printing system, this vulnerability may lead to remotely induced privilege escalation.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

In an iDEFENSE Security Advisory infamous41md reports :

Remote exploitation of a heap-based buffer overflow vulnerability within the LibTIFF package could allow attackers to execute arbitrary code.

The vulnerability specifically exists due to insufficient validation of user-supplied data when calculating the size of a directory entry.
A TIFF file includes a number of directory entry header fields that describe the data in the file. Included in these entries is an entry count and offset value that are calculated to determine the size and location of the data for that entry.

The remote host is missing Security Update 2005-005. This security
update contains security fixes for the following application :

- Apache
- AppKit
- AppleScript
- Bluetooth
- Directory Services
- Finder
- Foundation
- HelpViewer
- LDAP
- libXpm
- lukemftpd
- NetInfo
- ServerAdmin
- sudo
- Terminal
- VPN 

The remote host is missing Security Update 2005-005. This security update contains fixes for the following applications :

  - Apache
  - AppKit
  - AppleScript
  - Bluetooth
  - Directory Services
  - Finder
  - Foundation
  - HelpViewer
  - LDAP
  - libXpm
  - lukemftpd
  - NetInfo
  - ServerAdmin
  - sudo
  - Terminal
  - VPN

These programs have multiple vulnerabilities that could allow a remote attacker to execute arbitrary code.

Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform.
(formerly CVE-2004-0888). This also affects applications like kdegraphics, that use embedded versions of xpdf. (CVE-2005-0206)

In addition, previous libtiff updates overlooked kdegraphics, which contains and embedded libtiff used for kfax. This update includes patches to address: CVE-2004-0803, CVE-2004-0804, CVE-2004-0886, CVE-2004-1183, CVE-2004-1308.

The updated packages are patched to deal with these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:035 advisory.

    The libtiff package contains a library of functions for manipulating TIFF     (Tagged Image File Format) image format files.

    infamous41md discovered integer overflow flaws in libtiff.  An attacker     could create a carefully crafted TIFF file in such a way that it could     cause an application linked with libtiff to overflow a heap buffer when the     file was opened by a victim.  Due to the nature of the overflow it is     unlikely that it is possible to use this flaw to execute arbitrary code.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2004-1308 to this issue.

    Dmitry V. Levin discovered an integer overflow flaw in libtiff.  An     attacker could create a carefully crafted TIFF file in such a way that it     could cause an application linked with libtiff to crash.  The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2004-1183 to this issue.

    All users are advised to upgrade to these updated packages, which contain     backported fixes for these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200501-06 (tiff: New overflows in image decoding)

    infamous41md found a potential integer overflow in the directory     entry count routines of the TIFF library (CAN-2004-1308). Dmitry V.
    Levin found another similar issue in the tiffdump utility     (CAN-2004-1183).
  Impact :

    A remote attacker could entice a user to view a carefully crafted     TIFF image file, which would potentially lead to execution of arbitrary     code with the rights of the user viewing the image. This affects any     program that makes use of the TIFF library, including many web browsers     or mail readers.
  Workaround :

    There is no known workaround at this time.

The remote host is missing the patch for the advisory SUSE-SA:2005:001 (libtiff/tiff).


Libtiff supports reading, writing, and manipulating of TIFF image files.
iDEFENSE reported an integer overflow in libtiff that can be exploited by specific TIFF images to trigger a heap-based buffer overflow afterwards.

This bug can be used by external attackers to execute arbitrary code over the network by placing special image files on web-pages and alike.

Additionally a buffer overflow in tiffdump was fixed.

Updated libtiff packages that fix various integer overflows are now available.

The libtiff package contains a library of functions for manipulating TIFF (Tagged Image File Format) image format files.

iDEFENSE has reported an integer overflow bug that affects libtiff. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause the application linked to libtiff to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1308 to this issue.

Dmitry V. Levin reported another integer overflow in the tiffdump utility. An attacker who has the ability to trick a user into opening a malicious TIFF file with tiffdump could possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1183 to this issue.

All users are advised to upgrade to these updated packages, which contain backported fixes for these issues.

Several vulnerabilities have been discovered in the libtiff package;
wxGTK2 uses a libtiff code tree, so it may have the same vulnerabilities :

iDefense reported the possibility of remote exploitation of an integer overflow in libtiff that may allow for the execution of arbitrary code.

The overflow occurs in the parsing of TIFF files set with the STRIPOFFSETS flag.

iDefense also reported a heap-based buffer overflow vulnerability within the LibTIFF package could allow attackers to execute arbitrary code. (CVE-2004-1308)

The vulnerability specifically exists due to insufficient validation of user-supplied data when calculating the size of a directory entry.

The updated packages are patched to protect against these vulnerabilities.

Several vulnerabilities have been discovered in the libtiff package :

iDefense reported the possibility of remote exploitation of an integer overflow in libtiff that may allow for the execution of arbitrary code.

The overflow occurs in the parsing of TIFF files set with the STRIPOFFSETS flag.

iDefense also reported a heap-based buffer overflow vulnerability within the LibTIFF package could allow attackers to execute arbitrary code. (CVE-2004-1308)

The vulnerability specifically exists due to insufficient validation of user-supplied data when calculating the size of a directory entry.

The updated packages are patched to protect against these vulnerabilities.

'infamous41md' discovered a problem in libtiff, the Tag Image File Format library for processing TIFF graphics files. Upon reading a TIFF file it is possible to allocate a zero sized buffer and write to it which would lead to the execution of arbitrary code.

The remote host is missing Security Update 2005-005. This security
update contains security fixes for the following application :

- Apache
- AppKit
- AppleScript
- Bluetooth
- Directory Services
- Finder
- Foundation
- HelpViewer
- LDAP
- libXpm
- lukemftpd
- NetInfo
- ServerAdmin
- sudo
- Terminal
- VPN

ID	Name	Product	Family	Severity
21795	CentOS 3 : kdegraphics (CESA-2005:021)	Nessus	CentOS Local Security Checks	critical
20663	Ubuntu 4.10 : tiff vulnerability (USN-46-1)	Nessus	Ubuntu Local Security Checks	critical
19184	FreeBSD : tiff -- directory entry count integer overflow vulnerability (fc7e6a42-6012-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	critical
2878	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Nessus Network Monitor	Web Clients	high
18189	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Nessus	MacOS X Local Security Checks	high
18017	RHEL 2.1 / 3 : kdegraphics (RHSA-2005:021)	Nessus	Red Hat Local Security Checks	critical
17281	Mandrake Linux Security Advisory : kdegraphics (MDKSA-2005:052)	Nessus	Mandriva Local Security Checks	critical
17169	RHEL 4 : libtiff (RHSA-2005:035)	Nessus	Red Hat Local Security Checks	high
16397	GLSA-200501-06 : tiff: New overflows in image decoding	Nessus	Gentoo Local Security Checks	critical
16305	SUSE-SA:2005:001: libtiff/tiff	Nessus	SuSE Local Security Checks	critical
16159	RHEL 2.1 / 3 : libtiff (RHSA-2005:019)	Nessus	Red Hat Local Security Checks	critical
16115	Mandrake Linux Security Advisory : wxGTK2 (MDKSA-2005:002)	Nessus	Mandriva Local Security Checks	critical
16114	Mandrake Linux Security Advisory : libtiff (MDKSA-2005:001)	Nessus	Mandriva Local Security Checks	critical
16048	Debian DSA-617-1 : tiff - insufficient input validation	Nessus	Debian Local Security Checks	critical
800799	Mac OS X Multiple Vulnerabilities (Security Update 2005-005)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2004-1308

critical

Tenable Plugins

critical

critical

critical

high

high

critical

critical

high

critical

critical

critical

critical

critical

critical

high