Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.

The remote NewStart CGSL host, running version MAIN 6.02, has libtiff packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a     DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign     extended to an integer that produces more digits than expected in an sprintf call. (CVE-2006-2193)

  - Heap-based buffer overflow in the JPEG decoder in the TIFF library (libtiff) before 3.8.2 allows context-     dependent attackers to cause a denial of service and possibly execute arbitrary code via an encoded JPEG     stream that is longer than the scan line size (TiffScanLineSize). (CVE-2006-3460)

  - Heap-based buffer overflow in the PixarLog decoder in the TIFF library (libtiff) before 3.8.2 might allow     context-dependent attackers to execute arbitrary code via unknown vectors. (CVE-2006-3461)

  - Heap-based buffer overflow in the NeXT RLE decoder in the TIFF library (libtiff) before 3.8.2 might allow     context-dependent attackers to execute arbitrary code via unknown vectors involving decoding large RLE     images. (CVE-2006-3462)

  - The EstimateStripByteCounts function in TIFF library (libtiff) before 3.8.2 uses a 16-bit unsigned short     when iterating over an unsigned 32-bit value, which allows context-dependent attackers to cause a denial     of service via a large td_nstrips value, which triggers an infinite loop. (CVE-2006-3463)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2008:0848 :

Updated libtiff packages that fix various security issues and a bug are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.

A buffer overflow flaw was discovered in the tiff2pdf conversion program distributed with libtiff. An attacker could create a TIFF file containing UTF-8 characters that would, when converted to PDF format, cause tiff2pdf to crash, or, possibly, execute arbitrary code.
(CVE-2006-2193)

Additionally, these updated packages fix the following bug :

* the libtiff packages included manual pages for the sgi2tiff and tiffsv commands, which are not included in these packages. These extraneous manual pages were removed.

All libtiff users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated libtiff packages that fix various security issues and a bug are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.

A buffer overflow flaw was discovered in the tiff2pdf conversion program distributed with libtiff. An attacker could create a TIFF file containing UTF-8 characters that would, when converted to PDF format, cause tiff2pdf to crash, or, possibly, execute arbitrary code.
(CVE-2006-2193)

Additionally, these updated packages fix the following bug :

* the libtiff packages included manual pages for the sgi2tiff and tiffsv commands, which are not included in these packages. These extraneous manual pages were removed.

All libtiff users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)

SL4: A buffer overflow flaw was discovered in the tiff2pdf conversion program distributed with libtiff. An attacker could create a TIFF file containing UTF-8 characters that would, when converted to PDF format, cause tiff2pdf to crash, or, possibly, execute arbitrary code.
(CVE-2006-2193)

SL4 &amp; SL5: Additionally, these updated packages fix the following bug :

  - the libtiff packages included manual pages for the     sgi2tiff and tiffsv commands, which are not included in     these packages. These extraneous manual pages were     removed.

A buffer overflow has been found in the tiff2pdf utility. By tricking an user into processing a specially crafted TIF file with tiff2pdf, this could potentially be exploited to execute arbitrary code with the privileges of the user. (CVE-2006-2193)

A. Alejandro Hernandez discovered a buffer overflow in the tiffsplit utility. By calling tiffsplit with specially crafted long arguments, an user can execute arbitrary code. If tiffsplit is used in e. g. a web-based frontend or similar automated system, this could lead to remote arbitary code execution with the privileges of that system. (In normal interactive command line usage this is not a vulnerability.) (CVE-2006-2656).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several problems have been discovered in the TIFF library. The Common Vulnerabilities and Exposures project identifies the following issues :

  - CVE-2006-2193     SuSE discovered a buffer overflow in the conversion of     TIFF files into PDF documents which could be exploited     when tiff2pdf is used e.g. in a printer filter.

  - CVE-2006-2656     The tiffsplit command from the TIFF library contains a     buffer overflow in the commandline handling which could     be exploited when the program is executed automatically     on unknown filenames.

The remote host is affected by the vulnerability described in GLSA-200607-03 (libTIFF: Multiple buffer overflows)

    A buffer overflow has been found in the t2p_write_pdf_string function     in tiff2pdf, which can been triggered with a TIFF file containing a     DocumentName tag with UTF-8 characters. An additional buffer overflow     has been found in the handling of the parameters in tiffsplit.
  Impact :

    A remote attacker could entice a user to load a specially crafted TIFF     file, resulting in the possible execution of arbitrary code.
  Workaround :

    There is no known workaround at this time.

A buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in a sprintf call.

Corporate Server 3 and Corporate Desktop 3 are not affected by this vulnerability as tiff2pdf was not part of the libtiff version shipped in those products.

The updated packages have been patched to correct this issue.

ID	Name	Product	Family	Type	Severity
206852	NewStart CGSL MAIN 6.02 : libtiff Multiple Vulnerabilities (NS-SA-2024-0051)	Nessus	NewStart CGSL Local Security Checks	Local	high
67740	Oracle Linux 4 : libtiff (ELSA-2008-0848)	Nessus	Oracle Linux Local Security Checks	Local	high
67063	CentOS 4 : libtiff (CESA-2008:0848)	Nessus	CentOS Local Security Checks	Local	high
60471	Scientific Linux Security Update : libtiff on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	Local	high
34064	RHEL 4 : libtiff (RHSA-2008:0848)	Nessus	Red Hat Local Security Checks	Local	high
27861	Ubuntu 5.04 / 5.10 / 6.06 LTS : tiff vulnerabilities (USN-289-1)	Nessus	Ubuntu Local Security Checks	Local	high
22633	Debian DSA-1091-1 : tiff - buffer overflows	Nessus	Debian Local Security Checks	Local	high
22010	GLSA-200607-03 : libTIFF: Multiple buffer overflows	Nessus	Gentoo Local Security Checks	Local	high
21717	Mandrake Linux Security Advisory : libtiff (MDKSA-2006:102)	Nessus	Mandriva Local Security Checks	Local	high

Detections

Analytics

CVE-2006-2193

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high