Integer overflow in the tiffdump utility for libtiff 3.7.1 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted TIFF file.

Dmitry V. Levin discovered a buffer overflow in the 'tiffdump' utility. If an attacker tricked a user into processing a malicious TIFF image with tiffdump, they could cause a buffer overflow which at least causes the program to crash. However, it is not entirely clear whether this can be exploited to execute arbitrary code with the privileges of the user opening the image.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Dmitry V. Levin found a potential integer overflow in the tiffdump utility which could lead to execution of arbitrary code. This could be exploited by tricking an user into executing tiffdump on a specially crafted tiff image.

Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform.
(formerly CVE-2004-0888). This also affects applications like kdegraphics, that use embedded versions of xpdf. (CVE-2005-0206)

In addition, previous libtiff updates overlooked kdegraphics, which contains and embedded libtiff used for kfax. This update includes patches to address: CVE-2004-0803, CVE-2004-0804, CVE-2004-0886, CVE-2004-1183, CVE-2004-1308.

The updated packages are patched to deal with these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:035 advisory.

    The libtiff package contains a library of functions for manipulating TIFF     (Tagged Image File Format) image format files.

    infamous41md discovered integer overflow flaws in libtiff.  An attacker     could create a carefully crafted TIFF file in such a way that it could     cause an application linked with libtiff to overflow a heap buffer when the     file was opened by a victim.  Due to the nature of the overflow it is     unlikely that it is possible to use this flaw to execute arbitrary code.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2004-1308 to this issue.

    Dmitry V. Levin discovered an integer overflow flaw in libtiff.  An     attacker could create a carefully crafted TIFF file in such a way that it     could cause an application linked with libtiff to crash.  The Common     Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name     CAN-2004-1183 to this issue.

    All users are advised to upgrade to these updated packages, which contain     backported fixes for these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200501-06 (tiff: New overflows in image decoding)

    infamous41md found a potential integer overflow in the directory     entry count routines of the TIFF library (CAN-2004-1308). Dmitry V.
    Levin found another similar issue in the tiffdump utility     (CAN-2004-1183).
  Impact :

    A remote attacker could entice a user to view a carefully crafted     TIFF image file, which would potentially lead to execution of arbitrary     code with the rights of the user viewing the image. This affects any     program that makes use of the TIFF library, including many web browsers     or mail readers.
  Workaround :

    There is no known workaround at this time.

The remote host is missing the patch for the advisory SUSE-SA:2005:001 (libtiff/tiff).


Libtiff supports reading, writing, and manipulating of TIFF image files.
iDEFENSE reported an integer overflow in libtiff that can be exploited by specific TIFF images to trigger a heap-based buffer overflow afterwards.

This bug can be used by external attackers to execute arbitrary code over the network by placing special image files on web-pages and alike.

Additionally a buffer overflow in tiffdump was fixed.

Updated libtiff packages that fix various integer overflows are now available.

The libtiff package contains a library of functions for manipulating TIFF (Tagged Image File Format) image format files.

iDEFENSE has reported an integer overflow bug that affects libtiff. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause the application linked to libtiff to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1308 to this issue.

Dmitry V. Levin reported another integer overflow in the tiffdump utility. An attacker who has the ability to trick a user into opening a malicious TIFF file with tiffdump could possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1183 to this issue.

All users are advised to upgrade to these updated packages, which contain backported fixes for these issues.

Several vulnerabilities have been discovered in the libtiff package;
wxGTK2 uses a libtiff code tree, so it may have the same vulnerabilities :

iDefense reported the possibility of remote exploitation of an integer overflow in libtiff that may allow for the execution of arbitrary code.

The overflow occurs in the parsing of TIFF files set with the STRIPOFFSETS flag.

iDefense also reported a heap-based buffer overflow vulnerability within the LibTIFF package could allow attackers to execute arbitrary code. (CVE-2004-1308)

The vulnerability specifically exists due to insufficient validation of user-supplied data when calculating the size of a directory entry.

The updated packages are patched to protect against these vulnerabilities.

Several vulnerabilities have been discovered in the libtiff package :

iDefense reported the possibility of remote exploitation of an integer overflow in libtiff that may allow for the execution of arbitrary code.

The overflow occurs in the parsing of TIFF files set with the STRIPOFFSETS flag.

iDefense also reported a heap-based buffer overflow vulnerability within the LibTIFF package could allow attackers to execute arbitrary code. (CVE-2004-1308)

The vulnerability specifically exists due to insufficient validation of user-supplied data when calculating the size of a directory entry.

The updated packages are patched to protect against these vulnerabilities.

Dmitry V. Levin discovered a buffer overflow in libtiff, the Tag Image File Format library for processing TIFF graphics files. Upon reading a TIFF file it is possible to crash the application, and maybe also to execute arbitrary code.

ID	Name	Product	Family	Type	Severity
20672	Ubuntu 4.10 : tiff vulnerability (USN-54-1)	Nessus	Ubuntu Local Security Checks	Local	medium
19028	FreeBSD : tiff -- tiffdump integer overflow vulnerability (8f86d8b5-6025-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	Local	medium
17281	Mandrake Linux Security Advisory : kdegraphics (MDKSA-2005:052)	Nessus	Mandriva Local Security Checks	Local	critical
17169	RHEL 4 : libtiff (RHSA-2005:035)	Nessus	Red Hat Local Security Checks	Local	high
16397	GLSA-200501-06 : tiff: New overflows in image decoding	Nessus	Gentoo Local Security Checks	Local	critical
16305	SUSE-SA:2005:001: libtiff/tiff	Nessus	SuSE Local Security Checks		critical
16159	RHEL 2.1 / 3 : libtiff (RHSA-2005:019)	Nessus	Red Hat Local Security Checks	Local	critical
16115	Mandrake Linux Security Advisory : wxGTK2 (MDKSA-2005:002)	Nessus	Mandriva Local Security Checks	Local	critical
16114	Mandrake Linux Security Advisory : libtiff (MDKSA-2005:001)	Nessus	Mandriva Local Security Checks	Local	critical
16104	Debian DSA-626-1 : tiff - unsanitised input	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2004-1183

high

Tenable Plugins

medium

medium

critical

high

critical

critical

critical

critical

critical

medium