Detections
Analytics
F5 Networks BIG-IP : LibTIFF vulnerabilities (K89096577)
high Nessus Plugin ID 94648
Language:
Synopsis
The remote device is missing a vendor-supplied security patch.Description
CVE-2016-5314Buffer overflow in the PixarLogDecode function in tif_pixarlog.c in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by overwriting the vgetparent function pointer with rgb2ycbcr.
Note : This was previously referenced as CVE-2016-5320. All CVE users should reference CVE-2016-5314 instead of CVE-2016-5320.
CVE-2015-8784 The NeXTDecode function in tif_next.c in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted TIFF image, as demonstrated by libtiff5.tif.
Impact
An attacker can use specially crafted TIFF files to execute arbitrary code with the limited privileges of the image optimization process.
Solution
Upgrade to one of the non-vulnerable versions listed in the F5 Solution K89096577.See Also
Plugin Details
Severity: High
ID: 94648
File Name: f5_bigip_SOL89096577.nasl
Version: 2.14
Type: local
Published: 11/9/2016
Updated: 1/4/2019
Configuration: Enable paranoid mode
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:f5:big-ip_application_acceleration_manager, cpe:/a:f5:big-ip_webaccelerator, cpe:/h:f5:big-ip
Required KB Items: Host/local_checks_enabled, Host/BIG-IP/hotfix, Host/BIG-IP/modules, Host/BIG-IP/version, Settings/ParanoidReport
Exploit Ease: No known exploits are available
Patch Publication Date: 11/8/2016