The TIFFToRGB function in libtiff before 3.8.1 allows remote attackers to cause a denial of service (crash) via a crafted TIFF image with Yr/Yg/Yb values that exceed the YCR/YCG/YCB values, which triggers an out-of-bounds read.

Andrey Kiselev discovered a problem in the TIFF library that may allow an attacker with a specially crafted TIFF image with Yr/Yg/Yb values that exceed the YCR/YCG/YCB values to crash the library and hence the surrounding application.

Updated libtiff packages that fix several security flaws are now available for Red Hat Enterprise Linux.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff package contains a library of functions for manipulating TIFF (Tagged Image File Format) image format files.

An integer overflow flaw was discovered in libtiff. An attacker could create a carefully crafted TIFF file in such a way that it could cause an application linked with libtiff to crash or possibly execute arbitrary code. (CVE-2006-2025)

A double free flaw was discovered in libtiff. An attacker could create a carefully crafted TIFF file in such a way that it could cause an application linked with libtiff to crash or possibly execute arbitrary code. (CVE-2006-2026)

Several denial of service flaws were discovered in libtiff. An attacker could create a carefully crafted TIFF file in such a way that it could cause an application linked with libtiff to crash.
(CVE-2006-2024, CVE-2006-2120)

All users are advised to upgrade to these updated packages, which contain backported fixes for these issues.

Tavis Ormandy and Andrey Kiselev discovered that libtiff did not sufficiently verify the validity of TIFF files. By tricking an user into opening a specially crafted TIFF file with any application that uses libtiff, an attacker could exploit this to crash the application or even execute arbitrary code with the application's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2006:0425 advisory.

    The libtiff package contains a library of functions for manipulating TIFF     (Tagged Image File Format) image format files.

    An integer overflow flaw was discovered in libtiff. An attacker could     create a carefully crafted TIFF file in such a way that it could cause an     application linked with libtiff to crash or possibly execute arbitrary     code. (CVE-2006-2025)

    A double free flaw was discovered in libtiff. An attacker could create a     carefully crafted TIFF file in such a way that it could cause an     application linked with libtiff to crash or possibly execute arbitrary     code. (CVE-2006-2026)

    Several denial of service flaws were discovered in libtiff. An attacker     could create a carefully crafted TIFF file in such a way that it could     cause an application linked with libtiff to crash. (CVE-2006-2024,     CVE-2006-2120)

    All users are advised to upgrade to these updated packages, which contain     backported fixes for these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several bugs were discovered in libtiff that can lead to remote Denial of Service attacks. These bugs can only be triggered by a user using an application that uses libtiff to process malformed TIFF images.

The updated packages have been patched to correct these issues.

ID	Name	Product	Family	Severity
22620	Debian DSA-1078-1 : tiff - out-of-bounds read	Nessus	Debian Local Security Checks	low
21900	CentOS 3 / 4 : libtiff (CESA-2006:0425)	Nessus	CentOS Local Security Checks	medium
21371	Ubuntu 5.04 / 5.10 : tiff vulnerabilities (USN-277-1)	Nessus	Ubuntu Local Security Checks	medium
21365	RHEL 4 : libtiff (RHSA-2006:0425)	Nessus	Red Hat Local Security Checks	medium
21357	Mandrake Linux Security Advisory : libtiff (MDKSA-2006:082)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2006-2120

medium

Tenable Plugins

low

medium

medium

medium

medium