libtiff 4.0.6 tiffcrop _TIFFFax3fillruns(): divide by zero

2016.07.19
Risk: Low
Local: No
Remote: Yes
CWE: CWE-369


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: None
Availability impact: Partial

Details ======= Product: libtiff Affected Versions: <= 4.0.6 Vulnerability Type: divide by zero Vendor URL: http://www.remotesensing.org/libtiff/ Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360 CVE ID: CVE-2016-5323 Tested system version: fedora23 32bit fedora23 64bit CentOS Linux release 7.1.1503 64bit Introduction ======= t was always corrupted when I use tiffcrop command followed by a crafted TIFF image in function _TIFFFax3fillruns () without checking the value of divisor, it causes a divide by zero flaw. Attackers cound exploit this issue to cause denial-of-service. Here is the stack info: gdb –args ./tiffcrop _TIFFFax3fillruns.tif tmpout.tif --- --- Program received signal SIGSEGV, Segmentation fault. 0x00007ffff7ad97f0 in _TIFFFax3fillruns (buf=0x0, runs=0x673500, erun=<optimized out>, lastx=64) at tif_fax3.c:407 407 ZERO(n, cp); (gdb) bt #0 0x00007ffff7ad97f0 in _TIFFFax3fillruns (buf=0x0, runs=0x673500, erun=<optimized out>, lastx=64) at tif_fax3.c:407 #1 0x00007ffff7ae087c in Fax3DecodeRLE (tif=0x662010, buf=0x0, occ=8192, s=<optimized out>) at tif_fax3.c:1527 #2 0x00007ffff7ba3739 in TIFFReadEncodedTile (tif=tif@entry=0x662010, tile=8, buf=0x0, size=8192, size@entry=-1) at tif_read.c:668 #3 0x00007ffff7ba3a01 in TIFFReadTile (tif=tif@entry=0x662010, buf=<optimized out>, x=x@entry=0, y=y@entry=0, z=z@entry=0, s=s@entry=8) at tif_read.c:641 #4 0x0000000000443e41 in readSeparateTilesIntoBuffer (bps=1, spp=129, tl=1024, tw=64, imagewidth=32, imagelength=32, obuf=0x7ffff7ee5010 "", in=0x662010) at tiffcrop.c:994 #5 loadImage (in=in@entry=0x662010, image=image@entry=0x7fffffff7960, dump=dump@entry=0x7fffffffc270, read_ptr=read_ptr@entry=0x7fffffff7920) at tiffcrop.c:6079 #6 0x0000000000403209 in main (argc=<optimized out>, argv=<optimized out>) at tiffcrop.c:2278 (gdb) p cp $2 = (unsigned char *) 0x0

References:

https://github.com/vadz/libtiff/commit/2f79856097f423eb33796a15fcf700d2ea41bf31
https://github.com/vadz/libtiff/commit/d9783e4a1476b6787a51c5ae9e9b3156527589f0


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top