Integer overflow in the TIFFFetchData function in tif_dirread.c for libtiff before 3.8.1 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via a crafted TIFF image.

From Red Hat Security Advisory 2006:0648 :

Updated kdegraphics packages that fix several security flaws in kfax are now available for Red Hat Enterprise Linux 2.1, and 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdegraphics package contains graphics applications for the K Desktop Environment.

Tavis Ormandy of Google discovered a number of flaws in libtiff during a security audit. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these flaws. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. (CVE-2006-3459, CVE-2006-3460, CVE-2006-3461, CVE-2006-3462, CVE-2006-3463, CVE-2006-3464, CVE-2006-3465)

Red Hat Enterprise Linux 4 is not vulnerable to these issues as kfax uses the shared libtiff library which has been fixed in a previous update.

Users of kfax should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue.

Tavis Ormandy discovered several vulnerabilities in the TIFF library that can lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-2024     Multiple vulnerabilities allow attackers to cause a     denial of service.

  - CVE-2006-2025     An integer overflow allows attackers to cause a denial     of service and possibly execute arbitrary code.

  - CVE-2006-2026     A double-free vulnerability allows attackers to cause a     denial of service and possibly execute arbitrary code.

Updated kdegraphics packages that fix several security flaws in kfax are now available for Red Hat Enterprise Linux 2.1, and 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdegraphics package contains graphics applications for the K Desktop Environment.

Tavis Ormandy of Google discovered a number of flaws in libtiff during a security audit. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these flaws. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. (CVE-2006-3459, CVE-2006-3460, CVE-2006-3461, CVE-2006-3462, CVE-2006-3463, CVE-2006-3464, CVE-2006-3465)

Red Hat Enterprise Linux 4 is not vulnerable to these issues as kfax uses the shared libtiff library which has been fixed in a previous update.

Users of kfax should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue.

Updated libtiff packages that fix several security flaws are now available for Red Hat Enterprise Linux.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff package contains a library of functions for manipulating TIFF (Tagged Image File Format) image format files.

An integer overflow flaw was discovered in libtiff. An attacker could create a carefully crafted TIFF file in such a way that it could cause an application linked with libtiff to crash or possibly execute arbitrary code. (CVE-2006-2025)

A double free flaw was discovered in libtiff. An attacker could create a carefully crafted TIFF file in such a way that it could cause an application linked with libtiff to crash or possibly execute arbitrary code. (CVE-2006-2026)

Several denial of service flaws were discovered in libtiff. An attacker could create a carefully crafted TIFF file in such a way that it could cause an application linked with libtiff to crash.
(CVE-2006-2024, CVE-2006-2120)

All users are advised to upgrade to these updated packages, which contain backported fixes for these issues.

The remote host is affected by the vulnerability described in GLSA-200605-17 (libTIFF: Multiple vulnerabilities)

    Multiple vulnerabilities, ranging from integer overflows and NULL     pointer dereferences to double frees, were reported in libTIFF.
  Impact :

    An attacker could exploit these vulnerabilities by enticing a user     to open a specially crafted TIFF image, possibly leading to the     execution of arbitrary code or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

Tavis Ormandy and Andrey Kiselev discovered that libtiff did not sufficiently verify the validity of TIFF files. By tricking an user into opening a specially crafted TIFF file with any application that uses libtiff, an attacker could exploit this to crash the application or even execute arbitrary code with the application's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2006:0425 advisory.

    The libtiff package contains a library of functions for manipulating TIFF     (Tagged Image File Format) image format files.

    An integer overflow flaw was discovered in libtiff. An attacker could     create a carefully crafted TIFF file in such a way that it could cause an     application linked with libtiff to crash or possibly execute arbitrary     code. (CVE-2006-2025)

    A double free flaw was discovered in libtiff. An attacker could create a     carefully crafted TIFF file in such a way that it could cause an     application linked with libtiff to crash or possibly execute arbitrary     code. (CVE-2006-2026)

    Several denial of service flaws were discovered in libtiff. An attacker     could create a carefully crafted TIFF file in such a way that it could     cause an application linked with libtiff to crash. (CVE-2006-2024,     CVE-2006-2120)

    All users are advised to upgrade to these updated packages, which contain     backported fixes for these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several bugs were discovered in libtiff that can lead to remote Denial of Service attacks. These bugs can only be triggered by a user using an application that uses libtiff to process malformed TIFF images.

The updated packages have been patched to correct these issues.

ID	Name	Product	Family	Severity
67404	Oracle Linux 3 : kdegraphics (ELSA-2006-0648)	Nessus	Oracle Linux Local Security Checks	high
22596	Debian DSA-1054-1 : tiff - several vulnerabilities	Nessus	Debian Local Security Checks	medium
22293	RHEL 2.1 / 3 : kdegraphics (RHSA-2006:0648)	Nessus	Red Hat Local Security Checks	high
22282	CentOS 3 : kdegraphics (CESA-2006:0648)	Nessus	CentOS Local Security Checks	high
21900	CentOS 3 / 4 : libtiff (CESA-2006:0425)	Nessus	CentOS Local Security Checks	medium
21615	GLSA-200605-17 : libTIFF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
21371	Ubuntu 5.04 / 5.10 : tiff vulnerabilities (USN-277-1)	Nessus	Ubuntu Local Security Checks	medium
21365	RHEL 4 : libtiff (RHSA-2006:0425)	Nessus	Red Hat Local Security Checks	medium
21357	Mandrake Linux Security Advisory : libtiff (MDKSA-2006:082)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2006-2025

high

Tenable Plugins

high

medium

high

high

medium

medium

medium

medium

medium