LibTIFF Library Anonymous Field Merging Denial of Service Vulnerability

Bugtraq ID:	19287
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2006-3465
Remote:	Yes
Local:	No
Published:	Aug 01 2006 12:00AM
Updated:	Mar 19 2015 09:29AM
Credit:	These issues were disclosed by Tavis Ormandy of the Google Security Team.
Vulnerable:	Ubuntu Ubuntu Linux 5.10 sparc Ubuntu Ubuntu Linux 5.10 powerpc Ubuntu Ubuntu Linux 5.10 i386 Ubuntu Ubuntu Linux 5.10 amd64 Ubuntu Ubuntu Linux 5.0 4 powerpc Ubuntu Ubuntu Linux 5.0 4 i386 Ubuntu Ubuntu Linux 5.0 4 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 Trustix Secure Enterprise Linux 2.0 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 8 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise SDK 10 Sun Solaris 9_x86 Sun Solaris 9_sparc Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 10_x86 Sun Solaris 10_sparc Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 9.0 SGI ProPack 3.0 SP6 S.u.S.E. UnitedLinux 1.0 S.u.S.E. Novell Linux Desktop 1.0 S.u.S.E. Linux Professional 10.0 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Desktop 1.0 rPath rPath Linux 1 RedHat kernel-BOOT-2.2.12-20.i386.rpm + RedHat Linux 6.1 RedHat kernel-bigmem-2.4.20-8.i686.rpm + RedHat Linux 9.0 i386 RedHat kernel-bigmem-2.4.18-3.i686.rpm RedHat kernel-bigmem-2.4.18-14.i686.rpm + RedHat Linux 8.0 RedHat kernel-2.4.7-10.i686.rpm + RedHat Linux 7.2 RedHat kernel-2.4.7-10.i386.rpm RedHat kernel-2.4.7-10.athlon.rpm RedHat kernel-2.4.21-27 RedHat kernel-2.4.20-8.i686.rpm RedHat kernel-2.4.20-8.i586.rpm + RedHat Linux 9.0 i386 RedHat kernel-2.4.20-8.i386.rpm RedHat kernel-2.4.20-8.athlon.rpm + RedHat Linux 9.0 i386 RedHat kernel-2.4.2-2.i686.rpm RedHat kernel-2.4.2-2.i586.rpm RedHat kernel-2.4.2-2.i386.rpm RedHat kernel-2.4.18-3.i686.rpm RedHat kernel-2.4.18-3.i386.rpm RedHat kernel-2.4.18-3.athlon.rpm + RedHat Linux 7.3 RedHat kernel-2.4.18-14.i686.rpm RedHat kernel-2.4.18-14.i586.rpm RedHat kernel-2.4.18-14.athlon.rpm RedHat kernel-2.2.5-15.i686.rpm RedHat kernel-2.2.5-15.i586.rpm RedHat kernel-2.2.5-15.i386.rpm RedHat kernel-2.2.16-22.i686.rpm RedHat kernel-2.2.16-22.i586.rpm + RedHat Linux 7.0 RedHat kernel-2.2.16-22.i386.rpm RedHat kernel-2.2.14-5.0.i686.rpm RedHat kernel-2.2.14-5.0.i586.rpm RedHat kernel-2.2.14-5.0.i386.rpm RedHat kernel-2.2.12-20.i686.rpm RedHat kernel-2.2.12-20.i586.rpm RedHat kernel-2.2.12-20.i386.rpm RedHat kermit 1.0 -3 RedHat kdepim-devel-3.1-5.i386.rpm RedHat kdepim-3.1-5.i386.rpm RedHat kdelibs-sound-devel-2.2.2-8.ia64.rpm RedHat kdelibs-sound-devel-2.2.2-8.i386.rpm RedHat kdelibs-sound-devel-2.2.2-0.71.3.i386.rpm RedHat kdelibs-sound-devel-2.2-11.ia64.rpm RedHat kdelibs-sound-devel-2.2-11.i386.rpm RedHat kdelibs-sound-devel-2.1.1-5.i386.rpm RedHat kdelibs-sound-2.2.2-8.ia64.rpm + RedHat Linux 7.2 ia64 RedHat kdelibs-sound-2.2.2-8.i386.rpm RedHat kdelibs-sound-2.2.2-0.71.3.i386.rpm + RedHat Linux 7.1 i386 RedHat kdelibs-sound-2.2-11.ia64.rpm RedHat kdelibs-sound-2.2-11.i386.rpm RedHat kdelibs-sound-2.1.1-5.i386.rpm RedHat kdelibs-devel-3.1.4-4.x86_64.rpm + Red Hat Fedora Core2 RedHat kdelibs-devel-3.1-10.i386.rpm + RedHat Linux 9.0 i386 RedHat kdelibs-devel-3.0.3-8.i386.rpm RedHat kdelibs-devel-3.0.0-10.i386.rpm + RedHat Linux 7.3 i386 RedHat kdelibs-devel-2.2.2-8.ia64.rpm RedHat kdelibs-devel-2.2.2-8.i386.rpm RedHat kdelibs-devel-2.2.2-0.71.3.i386.rpm RedHat kdelibs-devel-2.2-11.ia64.rpm RedHat kdelibs-devel-2.2-11.i386.rpm RedHat kdelibs-devel-2.1.1-5.i386.rpm RedHat kdelibs-debuginfo-3.2.2-4.x86_64.rpm + Red Hat Fedora Core2 RedHat kdelibs-3.1.4-4.x86_64.rpm RedHat kdelibs-3.1-10.i386.rpm RedHat kdelibs-3.0.3-8.i386.rpm RedHat kdelibs-3.0.0-10.i386.rpm + RedHat Linux 7.3 i386 RedHat kdelibs-2.2.2-8.ia64.rpm RedHat kdelibs-2.2.2-8.i386.rpm + RedHat Linux 7.2 i386 RedHat kdelibs-2.2.2-0.71.3.i386.rpm RedHat kdelibs-2.2-11.ia64.rpm + RedHat Linux 7.2 i386 RedHat kdelibs-2.2-11.i386.rpm + RedHat Linux 7.2 i386 RedHat kdelibs-2.1.1-5.i386.rpm RedHat kdebase-devel-3.0.3-13.i386.rpm + RedHat Linux 8.0 i386 RedHat kdebase-3.0.3-13.i386.rpm RedHat joe-2.9.7-4.i386.rpm RedHat joe-2.8-40.i386.rpm RedHat joe-2.8-24.i386.rpm RedHat joe-2.8-22.i386.rpm RedHat joe-2.8-18.i386.rpm RedHat joe-2.8-14.i386.rpm RedHat itcl-3.1.0-53.i386.rpm RedHat itcl-3.1.0-46.i386.rpm RedHat iputils-20000418-6.i386.rpm RedHat iputils-20000121-2.i386.rpm + Red Hat Linux 6.2 RedHat iptables-ipv6-1.2.6a-2.i386.rpm RedHat iptables-ipv6-1.2.5-3.i386.rpm RedHat iptables-ipv6-1.2.3-1.i386.rpm RedHat iptables-ipv6-1.2.1a-1.i386.rpm RedHat iptables-1.2.6a-2.i386.rpm RedHat iptables-1.2.5-3.i386.rpm + RedHat Linux 7.3 i386 RedHat iptables-1.2.3-1.i386.rpm RedHat iproute-debuginfo-2.4.7-11.x86_64.rpm RedHat iproute-debuginfo-2.4.7-11.i386.rpm RedHat iproute-2.4.7-11.x86_64.rpm + Red Hat Fedora Core1 RedHat iproute-2.4.7-11.i386.rpm + Red Hat Fedora Core1 RedHat Interchange 4.8.6 RedHat Interchange 4.8.5 RedHat Interchange 4.8.4 RedHat Interchange 4.8.3 RedHat Interchange 4.8.2 RedHat Interchange 4.8.1 RedHat initscripts 7.93.24 RedHat inetd-0.16-4.i386.rpm + Red Hat Linux 6.2 RedHat imap 4.5 -4 RedHat httpd-manual-2.0.40-8.i386.rpm RedHat httpd-manual-2.0.40-21.i386.rpm + RedHat Linux 9.0 i386 RedHat httpd-devel-2.0.40-8.i386.rpm RedHat httpd-devel-2.0.40-21.i386.rpm + RedHat Linux 9.0 i386 RedHat httpd-2.0.40-8.i386.rpm RedHat httpd-2.0.40-21.i386.rpm RedHat httpd-2.0.40-21.5.i386.rpm RedHat hanterm-xf-p19-15.ia64.rpm RedHat hanterm-xf-p19-15.i386.rpm RedHat hanterm-xf-2.0.5-5.8.0.i386.rpm + RedHat Linux 8.0 i386 RedHat hanterm-xf-2.0.5-5.7.4.ia64.rpm RedHat hanterm-xf-2.0.5-5.7.4.i386.rpm + RedHat Linux 7.2 i386 RedHat hanterm-xf-2.0.0-6.i386.rpm RedHat gnupg-1.2.1-3.i386.rpm RedHat gnupg-1.0.7-6.i386.rpm + RedHat Linux 8.0 i386 RedHat gnupg-1.0.6-5.i386.rpm RedHat gnupg-1.0.6-3.ia64.rpm RedHat gnupg-1.0.6-3.i386.rpm RedHat gnupg-1.0.4-11.i386.rpm RedHat gnome-core-devel-1.4.0.4-54.i386.rpm + RedHat Linux 7.3 i386 RedHat gnome-core-devel-1.0.39-10.i386.rpm RedHat gnome-core-1.4.0.4-54.i386.rpm + RedHat Linux 7.3 i386 RedHat gnome-core-1.0.39-10.i386.rpm + RedHat Linux 6.1 RedHat Glint 2.6.3 RedHat Glint 2.6.2 RedHat glibc-utils-2.2.93-5.i386.rpm RedHat glibc-utils-2.2.5-34.i386.rpm + RedHat Linux 7.3 RedHat glibc-profile-2.2.93-5.i386.rpm RedHat glibc-profile-2.2.5-34.i386.rpm + RedHat Linux 7.3 RedHat glibc-profile-2.2.4-13.i386.rpm RedHat glibc-profile-2.2.2-10.i386.rpm RedHat glibc-profile-2.1.92-14.i386.rpm RedHat glibc-profile-2.1.3-15.i386.rpm RedHat glibc-profile-2.1.2-11.i386.rpm RedHat glibc-profile-2.1.1-6.i386.rpm RedHat glibc-devel-2.2.93-5.i386.rpm RedHat glibc-devel-2.2.5-34.i386.rpm RedHat glibc-devel-2.2.4-13.i386.rpm RedHat glibc-devel-2.2.2-10.i386.rpm RedHat glibc-devel-2.1.92-14.i386.rpm + RedHat Linux 7.0 RedHat glibc-devel-2.1.3-15.i386.rpm RedHat glibc-devel-2.1.2-11.i386.rpm RedHat glibc-devel-2.1.1-6.i386.rpm + RedHat Linux 6.0 RedHat glibc-debug-static-2.2.93-5.i386.rpm RedHat glibc-debug-static-2.2.5-34.i386.rpm RedHat glibc-debug-2.2.93-5.i686.rpm RedHat glibc-debug-2.2.93-5.i386.rpm RedHat glibc-debug-2.2.5-34.i686.rpm RedHat glibc-debug-2.2.5-34.i386.rpm RedHat glibc-common-2.2.93-5.i386.rpm + RedHat Linux 8.0 RedHat glibc-common-2.2.5-34.i386.rpm RedHat glibc-common-2.2.4-13.i386.rpm RedHat glibc-common-2.2.2-10.i386.rpm RedHat glibc-2.2.93-5.i686.rpm RedHat glibc-2.2.93-5.i386.rpm RedHat glibc-2.2.5-34.i686.rpm RedHat glibc-2.2.5-34.i386.rpm + RedHat Linux 7.3 RedHat glibc-2.2.4-13.i686.rpm + RedHat Linux 7.2 RedHat glibc-2.2.4-13.i386.rpm RedHat glibc-2.2.2-10.i686.rpm RedHat glibc-2.2.2-10.i386.rpm + RedHat Linux 7.1 RedHat glibc-2.1.92-14.i686.rpm RedHat glibc-2.1.92-14.i386.rpm RedHat glibc-2.1.3-15.i386.rpm + Red Hat Linux 6.2 RedHat glibc-2.1.2-11.i386.rpm RedHat glibc-2.1.1-6.i386.rpm RedHat gkermit-1.0-9.i386.rpm RedHat gftp-2.0.7b-3.i386.rpm RedHat gftp-2.0.7b-2.i386.rpm RedHat gftp-2.0.6a-3.i386.rpm RedHat gftp-2.0.11-2.i386.rpm RedHat gdm-2.4.1.3-5.i386.rpm RedHat gdm-2.4.0.7-13.i386.rpm RedHat gdm-2.2.3.1-22.i386.rpm RedHat gdm-2.2.3.1-20.ia64.rpm RedHat gdm-2.2.3.1-20.i386.rpm RedHat gdm-2.0beta2-45.ppc.rpm RedHat gdm-2.0beta2-45.i386.rpm + RedHat Linux 7.1 i386 RedHat gdk-pixbuf-gnome-0.18.0-7.i386.rpm + RedHat Linux 9.0 i386 RedHat gdk-pixbuf-devel-0.18.0-7.i386.rpm RedHat gdk-pixbuf-0.18.0-7.i386.rpm + RedHat Linux 9.0 i386 RedHat gcc-3.2.2-6.i386.rpm 0 RedHat gcc-3.2.2-5.i386.rpm RedHat gcc-3.2-7.i386.rpm + RedHat Linux 8.0 i386 RedHat Fedora Directory Server 1.0.1 RedHat Fedora Directory Server 1.0 RedHat expect-5.31-53.i386.rpm RedHat expect-5.31-46.i386.rpm + RedHat Linux 7.0 RedHat ethereal-gnome-0.9.8-6.i386.rpm RedHat ethereal-0.9.8-6.i386.rpm + RedHat Linux 9.0 i386 RedHat esound-devel-0.2.14-1.i386.rpm RedHat esound-0.2.14-1.i386.rpm RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux WS 2.1 IA64 RedHat Enterprise Linux WS 2.1 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux ES 2.1 IA64 RedHat Enterprise Linux ES 2.1 RedHat Enterprise Linux Desktop version 4 RedHat dump-0.4b27-3.i386.rpm + RedHat Linux 7.3 i386 RedHat dump 0.4 b15-1 + RedHat Linux 6.2 sparc + RedHat Linux 6.2 i386 + RedHat Linux 6.2 alpha RedHat docbook-utils 0.6.9 -2 RedHat docbook-utils 0.6 -13 + HP Secure OS software for Linux 1.0 + RedHat Linux 7.1 noarch + RedHat Linux 7.1 ia64 + RedHat Linux 7.1 i686 + RedHat Linux 7.1 i586 + RedHat Linux 7.1 i386 + RedHat Linux 7.1 alpha + RedHat Linux 7.1 RedHat Directory Server 7.1 SP1 RedHat Directory Server 7.1 RedHat dip-3.3.7o-23.i386.rpm + RedHat Linux 7.3 i386 RedHat dip 3.3.7 o-8 RedHat diffutils-2.7-21.i386.rpm RedHat diffutils-2.7-17.i386.rpm RedHat diffutils-2.7-11.i386.rpm + RedHat Linux 5.2 RedHat Desktop 4.0 RedHat Desktop 3.0 RedHat ddskk-xemacs-11.6.0-8.noarch.rpm RedHat ddskk-xemacs-11.6.0-6.noarch.rpm + RedHat Linux 7.3 i386 RedHat ddskk-xemacs-11.6.0-10.noarch.rpm RedHat ddskk-11.6.0-8.noarch.rpm RedHat ddskk-11.6.0-6.noarch.rpm RedHat ddskk-11.6.0-10.noarch.rpm + RedHat Linux 8.0 i386 RedHat ddskk-11.3.20010617-2.noarch.rpm + RedHat Linux 7.2 i386 RedHat ddskk-11.3.20010225-5.noarch.rpm RedHat cvs-1.11.2-10.i386.rpm + RedHat Linux 9.0 i386 RedHat cups-libs-1.1.17-13.3.i386.rpm RedHat cups-libs-1.1.17-0.7.i386.rpm + RedHat Linux 8.0 i386 RedHat cups-libs-1.1.14-15.4.i386.rpm + RedHat Linux 7.2 i386 RedHat cups-devel-1.1.17-13.3.i386.rpm + RedHat Linux 9.0 i386 RedHat cups-devel-1.1.17-0.7.i386.rpm RedHat cups-devel-1.1.14-15.4.i386.rpm RedHat cups-1.1.17-13.3.i386.rpm RedHat cups-1.1.17-0.7.i386.rpm RedHat cups-1.1.14-15.4.i386.rpm RedHat Certificate Server 7.1 SP1 RedHat Certificate Server 7.1 RedHat bind-8.2.2_P5-9.i386.rpm RedHat bind-8.2.2_P5-25.i386.rpm RedHat bind-8.2.1-7.i386.rpm RedHat bind-8.2-6.i386.rpm RedHat bind-8.1.2-5.i386.rpm RedHat bash-2.05a-13.i386.rpm RedHat bash-1.14.7-22.i386.rpm + Red Hat Linux 6.2 RedHat bash-1.14.7-16.i386.rpm RedHat bash-1.14.7-13.i386.rpm + RedHat Linux 5.2 RedHat arts-2.2.2-8.ia64.rpm RedHat arts-2.2.2-8.i386.rpm RedHat arts-2.2.2-0.71.3.i386.rpm RedHat arts-2.2-11.ia64.rpm RedHat arts-2.2-11.i386.rpm RedHat arts-2.1.1-5.i386.rpm RedHat arts-1.0.0-4.i386.rpm RedHat arpwatch-2.1a11-7.1.x86_64.rpm RedHat arpwatch-2.1a11-7.1.i386.rpm + Red Hat Fedora Core1 RedHat arpwatch-2.1a11-1.i386.rpm RedHat Application Server WS 3 RedHat Application Server ES 3 RedHat Application Server AS 3 RedHat Advanced Workstation for the Itanium Processor 2.1 IA64 RedHat Advanced Workstation for the Itanium Processor 2.1 RedHat 7.0 traceroute 1.4 a5 + RedHat Linux 7.0 Red Hat Fedora Core6 Red Hat Fedora Core5 Red Hat Fedora Core4 Red Hat Fedora Core3 Red Hat Fedora Core2 Red Hat Fedora Core1 Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 Red Hat Enterprise Linux AS 2.1 IA64 Red Hat Enterprise Linux AS 2.1 Red Hat Cygwin 1.5.9 -1 Red Hat Cygwin 1.5.8 -1 Red Hat Cygwin 1.5.7 -1 Red Hat Cygwin 1.5.6 -1 Red Hat Cygwin 1.5.5 -1 Red Hat Cygwin 1.5.4 -1 Red Hat Cygwin 1.5.3 -1 Red Hat Cygwin 1.5.2 -1 Red Hat Cygwin 1.5.1 -1 Red Hat Cygwin 1.5 -1 Red Hat 6.2 traceroute 1.4 a5 Mandriva Linux Mandrake 2006.0 x86_64 Mandriva Linux Mandrake 2006.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Avaya Messaging Storage Server Avaya Message Networking Avaya Intuity LX Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.3.9 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.7 Apple iPod Touch 1.1.1 Apple iPod Touch 1.1 Apple iPhone 1.1.1 Apple iPhone 1.0.2 Apple iPhone 1.0.1 Apple iPhone 1
Not Vulnerable:

LibTIFF Library Anonymous Field Merging Denial of Service Vulnerability

The libTIFF library is prone to a denial-of-service vulnerability.

An attacker can exploit this issue by submitting malformed image files.

When the libTIFF library routines process a malicious TIFF file, this could result in abnormal behavior, cause the application to become unresponsive, or possibly allow malicious code to execute.

LibTIFF Library Anonymous Field Merging Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

LibTIFF Library Anonymous Field Merging Denial of Service Vulnerability

Solution:
The vendor has released a patch to address this issue.

Please see the referenced advisories for more information.


Red Hat Fedora Core1

• Fedora tcpdump-3.7.2-7.fc1.1.i386.rpm
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/i386 /tcpdump-3.7.2-7.fc1.1.i386.rpm


• Fedora tcpdump-debuginfo-3.7.2-7.fc1.1.i386.rpm
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/1/i386 /debug/tcpdump-debuginfo-3.7.2-7.fc1.1.i386.rpm

LibTIFF Library Anonymous Field Merging Denial of Service Vulnerability

References:

• ASA-2006-166 - libtiff security update (RHSA-2006-0603) (Avaya)
  
• LibTIFF Homepage (LibTIFF)
  
• RHSA-2006:0603-4 - libtiff security update (Red Hat)
  
• RHSA-2006:0648-4 - kdegraphics security update (Red Hat)
  
• Sun Advisory 201331 - Security Vulnerabilities in libtiff(3) May Allow Denial of (Sun)
  
• rPSA-2006-0142-1 libtiff (rPath)