Multiple buffer underflows in the (1) LZWDecode, (2) LZWDecodeCompat, and (3) LZWDecodeVector functions in tif_lzw.c in the LZW decoder in LibTIFF 3.8.2 and earlier allow context-dependent attackers to execute arbitrary code via a crafted TIFF file, related to improper handling of the CODE_CLEAR code.

The remote NewStart CGSL host, running version MAIN 6.02, has libtiff packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a     DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign     extended to an integer that produces more digits than expected in an sprintf call. (CVE-2006-2193)

  - Heap-based buffer overflow in the JPEG decoder in the TIFF library (libtiff) before 3.8.2 allows context-     dependent attackers to cause a denial of service and possibly execute arbitrary code via an encoded JPEG     stream that is longer than the scan line size (TiffScanLineSize). (CVE-2006-3460)

  - Heap-based buffer overflow in the PixarLog decoder in the TIFF library (libtiff) before 3.8.2 might allow     context-dependent attackers to execute arbitrary code via unknown vectors. (CVE-2006-3461)

  - Heap-based buffer overflow in the NeXT RLE decoder in the TIFF library (libtiff) before 3.8.2 might allow     context-dependent attackers to execute arbitrary code via unknown vectors involving decoding large RLE     images. (CVE-2006-3462)

  - The EstimateStripByteCounts function in TIFF library (libtiff) before 3.8.2 uses a 16-bit unsigned short     when iterating over an unsigned 32-bit value, which allows context-dependent attackers to cause a denial     of service via a large td_nstrips value, which triggers an infinite loop. (CVE-2006-3463)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix buffer overrun risks caused by unchecked integer     overflow (CVE-2009-2347) Resolves: #507725

  - Fix some more LZW decoding vulnerabilities     (CVE-2009-2285) Resolves: #507725

  - Update upstream URL

  - Use -fno-strict-aliasing per rpmdiff recommendation

  - Fix LZW decoding vulnerabilities (CVE-2008-2327)     Resolves: #458812

  - Remove sgi2tiff.1 and tiffsv.1, since they are for     programs we don't ship Resolves: #460120

From Red Hat Security Advisory 2008:0863 :

Updated libtiff packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.

All libtiff users are advised to upgrade to these updated packages, which contain backported patches to resolve this issue.

From Red Hat Security Advisory 2008:0848 :

Updated libtiff packages that fix various security issues and a bug are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.

A buffer overflow flaw was discovered in the tiff2pdf conversion program distributed with libtiff. An attacker could create a TIFF file containing UTF-8 characters that would, when converted to PDF format, cause tiff2pdf to crash, or, possibly, execute arbitrary code.
(CVE-2006-2193)

Additionally, these updated packages fix the following bug :

* the libtiff packages included manual pages for the sgi2tiff and tiffsv commands, which are not included in these packages. These extraneous manual pages were removed.

All libtiff users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2008-0847 advisory.

    - Fix LZW decoding vulnerabilities (CVE-2008-2327)     Resolves: #458812

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated libtiff packages that fix various security issues and a bug are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.

A buffer overflow flaw was discovered in the tiff2pdf conversion program distributed with libtiff. An attacker could create a TIFF file containing UTF-8 characters that would, when converted to PDF format, cause tiff2pdf to crash, or, possibly, execute arbitrary code.
(CVE-2006-2193)

Additionally, these updated packages fix the following bug :

* the libtiff packages included manual pages for the sgi2tiff and tiffsv commands, which are not included in these packages. These extraneous manual pages were removed.

All libtiff users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)

SL4: A buffer overflow flaw was discovered in the tiff2pdf conversion program distributed with libtiff. An attacker could create a TIFF file containing UTF-8 characters that would, when converted to PDF format, cause tiff2pdf to crash, or, possibly, execute arbitrary code.
(CVE-2006-2193)

SL4 &amp; SL5: Additionally, these updated packages fix the following bug :

  - the libtiff packages included manual pages for the     sgi2tiff and tiffsv commands, which are not included in     these packages. These extraneous manual pages were     removed.

Updated libtiff packages that fix a security issue and a bug are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.

Additionally, these updated packages fix the following bug :

* the libtiff packages included manual pages for the sgi2tiff and tiffsv commands, which are not included in these packages. These extraneous manual pages were removed.

All libtiff users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

A buffer underflow (CVE-2008-2327) has been fixed in libtiff.

a. Updated ESX Service Console package libxml2

   A denial of service flaw was found in the way libxml2 processes    certain content. If an application that is linked against    libxml2 processes malformed XML content, the XML content might    cause the application to stop responding.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-3281 to this issue.

   Additionally the following was also fixed, but was missing in the    security advisory.

   A heap-based buffer overflow flaw was found in the way libxml2    handled long XML entity names. If an application linked against    libxml2 processed untrusted malformed XML content, it could cause    the application to crash or, possibly, execute arbitrary code.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-3529 to this issue.

b. Updated ESX Service Console package ucd-snmp

   A flaw was found in the way ucd-snmp checks an SNMPv3 packet's    Keyed-Hash Message Authentication Code. An attacker could use    this flaw to spoof an authenticated SNMPv3 packet.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-0960 to this issue.

c. Updated third-party library libtiff

   Multiple uses of uninitialized values were discovered in libtiff's    Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker    could create a carefully crafted LZW-encoded TIFF file that would    cause an application linked with libtiff to crash or, possibly,    execute arbitrary code.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2008-2327 to this issue.

Drew Yao of the Apple Product Security Team reported multiple uses of uninitialized values in libtiff's LZW compression algorithm decoder.
An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked to libtiff to crash or potentially execute arbitrary code (CVE-2008-2327).

The updated packages have been patched to prevent this issue.

The version of Safari installed on the remote Windows host is earlier than 3.2.  Such versions are potentially affected by several issues : 


  - Safari includes a version of zlib that is affected by multiple vulnerabilities. (CVE-2005-2096)
  - A heap buffer overflow issue in the libxslt library could lead to a crash or arbitrary code execution. (CVE-2008-1767)
  - A signedness issue in Safari's handling of JavaScript array indices could lead to a crash or arbitrary code execution. (CVE-2008-2303)
  - A memory corruption issue in WebCore's handling of style sheet elements could lead to a crash or arbitrary code execution. (CVE-2008-2317)
  - Multiple uninitialized memory access issues in libTIFF's handling of LZW-encoded TIFF images could lead to a crash or arbitrary code execution. (CVE-2008-2327)
  - A memory corruption issue in ImageIO's handling of TIFF images could lead to a crash or arbitrary code execution. (CVE-2008-2332).
  - A memory corruption issue in ImageIO's handling of embedded ICC profiles in JPEG images could lead to a crash or arbitrary code execution. (CVE-2008-3608)
  - A heap buffer overflow in CoreGraphics' handling of color spaces could lead to a crash or arbitrary code execution. (CVE-2008-3623)
  - A buffer overflow in the handling of images with an embedded ICC profile could lead to a crash or arbitrary code execution. (CVE-2008-3642)
  - Disabling autocomplete on a form field may not prevent the data in the field from being stored in the browser page cache. (CVE-2008-3644)
  - WebKit's plug-in interface does not block plug-ins from launching local URLs, which could allow a remote attacker to launch local files in Safari and lead to the disclosure of sensitive information. (CVE-2008-4216)

The version of Safari installed on the remote Windows host is earlier than 3.2.  Such versions are potentially affected by several issues :

  - Safari includes a version of zlib that is affected by     multiple vulnerabilities. (CVE-2005-2096)

  - A heap-based buffer overflow issue in the libxslt library     could lead to a crash or arbitrary code execution.
    (CVE-2008-1767)

  - A signedness issue in Safari's handling of JavaScript     array indices could lead to a crash or arbitrary code     execution. (CVE-2008-2303)

  - A memory corruption issue in WebCore's handling of style     sheet elements could lead to a crash or arbitrary code     execution. (CVE-2008-2317)

  - Multiple uninitialized memory access issues in libTIFF's     handling of LZW-encoded TIFF images could lead to a     crash or arbitrary code execution. (CVE-2008-2327)

  - A memory corruption issue in ImageIO's handling of TIFF     images could lead to a crash or arbitrary code     execution. (CVE-2008-2332).

  - A memory corruption issue in ImageIO's handling of     embedded ICC profiles in JPEG images could lead to a     crash or arbitrary code execution. (CVE-2008-3608)

  - A heap-based buffer overflow in CoreGraphics' handling     of color spaces could lead to a crash or arbitrary code     execution. (CVE-2008-3623)

  - A buffer overflow in the handling of images with an     embedded ICC profile could lead to a crash or arbitrary     code execution. (CVE-2008-3642)

  - Disabling autocomplete on a form field may not prevent     the data in the field from being stored in the browser     page cache. (CVE-2008-3644)

  - WebKit's plug-in interface does not block plug-ins from     launching local URLs, which could allow a remote     attacker to launch local files in Safari and lead to the     disclosure of sensitive information. (CVE-2008-4216)

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.5.  Mac OS X 10.5.5 contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.5. 

Mac OS X 10.5.5 contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-006 applied. 

This update contains security fixes for a number of programs.

Fixes LZW decoding vulnerabilities described in CVE-2008-2327

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200809-07 (libTIFF: User-assisted execution of arbitrary code)

    Drew Yao (Apple Product Security) and Clay Wood reported multiple     buffer underflows in the LZWDecode() and LZWDecodeCompat() functions in     tif_lzw.c when processing TIFF files.
  Impact :

    A remote attacker could entice a user to open a specially crafted TIFF     file with an application making use of libTIFF, possibly resulting in     the remote execution of arbitrary code with the privileges of the user     running the application.
  Workaround :

    There is no known workaround at this time.

Drew Yao discovered that the TIFF library did not correctly validate LZW compressed TIFF images. If a user or automated system were tricked into processing a malicious image, a remote attacker could execute arbitrary code or cause an application linked against libtiff to crash, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated libtiff packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Multiple uses of uninitialized values were discovered in libtiff's Lempel-Ziv-Welch (LZW) compression algorithm decoder. An attacker could create a carefully crafted LZW-encoded TIFF file that would cause an application linked with libtiff to crash or, possibly, execute arbitrary code. (CVE-2008-2327)

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.

All libtiff users are advised to upgrade to these updated packages, which contain backported patches to resolve this issue.

Drew Yao discovered that libTIFF, a library for handling the Tagged Image File Format, is vulnerable to a programming error allowing malformed tiff files to lead to a crash or execution of arbitrary code.

ID	Name	Product	Family	Severity
206852	NewStart CGSL MAIN 6.02 : libtiff Multiple Vulnerabilities (NS-SA-2024-0051)	Nessus	NewStart CGSL Local Security Checks	high
79467	OracleVM 2.1 : libtiff (OVMSA-2009-0027)	Nessus	OracleVM Local Security Checks	high
67743	Oracle Linux 3 : libtiff (ELSA-2008-0863)	Nessus	Oracle Linux Local Security Checks	medium
67740	Oracle Linux 4 : libtiff (ELSA-2008-0848)	Nessus	Oracle Linux Local Security Checks	high
67739	Oracle Linux 5 : libtiff (ELSA-2008-0847)	Nessus	Oracle Linux Local Security Checks	critical
67063	CentOS 4 : libtiff (CESA-2008:0848)	Nessus	CentOS Local Security Checks	high
60471	Scientific Linux Security Update : libtiff on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
43707	CentOS 5 : libtiff (CESA-2008:0847)	Nessus	CentOS Local Security Checks	medium
41236	SuSE9 Security Update : libtiff (YOU Patch Number 12229)	Nessus	SuSE Local Security Checks	medium
40384	VMSA-2008-0017 : Updated ESX packages for libxml2, ucd-snmp, libtiff	Nessus	VMware ESX Local Security Checks	critical
40048	openSUSE Security Update : libtiff (libtiff-162)	Nessus	SuSE Local Security Checks	medium
37814	Mandriva Linux Security Advisory : libtiff (MDVSA-2008:184)	Nessus	Mandriva Local Security Checks	medium
4754	Safari < 3.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
34772	Safari < 3.2 Multiple Vulnerabilities	Nessus	Windows	high
4682	Mac OS X < 10.5.5 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
34211	Mac OS X 10.5.x < 10.5.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
34210	Mac OS X Multiple Vulnerabilities (Security Update 2008-006)	Nessus	MacOS X Local Security Checks	critical
34129	Fedora 8 : libtiff-3.8.2-11.fc8 (2008-7388)	Nessus	Fedora Local Security Checks	medium
34128	Fedora 9 : libtiff-3.8.2-11.fc9 (2008-7370)	Nessus	Fedora Local Security Checks	medium
34114	GLSA-200809-07 : libTIFF: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
34080	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : tiff vulnerability (USN-639-1)	Nessus	Ubuntu Local Security Checks	medium
34075	openSUSE 10 Security Update : libtiff (libtiff-5540)	Nessus	SuSE Local Security Checks	medium
34074	SuSE 10 Security Update : libtiff (ZYPP Patch Number 5538)	Nessus	SuSE Local Security Checks	medium
34065	RHEL 2.1 / 3 : libtiff (RHSA-2008:0863)	Nessus	Red Hat Local Security Checks	medium
34064	RHEL 4 : libtiff (RHSA-2008:0848)	Nessus	Red Hat Local Security Checks	high
34063	RHEL 5 : libtiff (RHSA-2008:0847)	Nessus	Red Hat Local Security Checks	medium
34062	CentOS 3 : libtiff (CESA-2008:0863)	Nessus	CentOS Local Security Checks	medium
34053	Debian DSA-1632-1 : tiff - buffer underflow	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2008-2327

critical

Tenable Plugins

high

high

medium

high

critical

high

high

medium

medium

critical

medium

medium

high

high

critical

critical

critical

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium