#2009-012 libtiff tools integer overflows Description: The libtiff image library tools suffer from integer overflows which may lead to a potentially exploitable heap overflow and result in arbitrary code execution. The libtiff package ships a library, for reading and writing TIFF, as well as a small collection of tools for manipulating TIFF images. The cvt_whole_image function used in the tiff2rgba tool and the tiffcvt function used in the rgb2ycbcr tool do not properly validate the width and height of the image. Specific TIFF images with large width and height can be crafted to trigger the vulnerability. A patch has been made available by the maintainer and further improved by Tom Lane of Red Hat. Affected version: libtiff <= 3.8.2, <= 3.9 (stable), <= 4.0 (development) Fixed version: libtiff, N/A (patch has been made available and it's expected to be committed to libtiff CVS) Credit: vulnerability report and PoC code received from Tielei Wang <wangtielei [at] icst [dot] pku [dot] edu [dot] cn>, ICST-ERCIS. CVE: CVE-2009-2347 Timeline: 2009-05-22: vulnerability report received 2009-05-22: contacted libtiff maintainer 2009-06-30: report resent to maintainer due to lack of response 2009-07-01: maintainer provides patch 2009-07-04: reporter confirm fixes 2009-07-04: oCERT requests one week embargo for vendor notification 2009-07-04: maintainer confirms embargo 2009-07-07: contacted affected vendors 2009-07-07: assigned CVE 2009-07-07: improved patch contributed by Tom Lane of Red Hat 2009-07-04: reporter acknowledges patch 2009-07-13: advisory release References: https://bugzilla.redhat.com/attachment.cgi?id=35132 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2347 Permalink: http://www.ocert.org/advisories/ocert-2009-012.html -- Andrea Barisani | Founder & Project Coordinator oCERT | Open Source Computer Emergency Response Team <lcars (at) ocert (dot) org [email concealed]> http://www.ocert.org 0x864C9B9E 0A76 074A 02CD E989 CE7F AC3F DA47 578E 864C 9B9E "Pluralitas non est ponenda sine necessitate"