LibTIFF 'TIFFScanlineSize()' Function Heap-based Buffer Overflow Vulnerability

Bugtraq ID:	56372
Class:	Boundary Condition Error
CVE:	CVE-2012-4564
Remote:	Yes
Local:	No
Published:	Nov 02 2012 12:00AM
Updated:	Apr 13 2015 10:21PM
Credit:	Huzaifa Sidhpurwala from Red Hat Security Response Team
Vulnerable:	Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 12.10 i386 Ubuntu Ubuntu Linux 12.10 amd64 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Slackware Linux x86_64 -current Slackware Linux 14.0 x86_64 Slackware Linux 14.0 Slackware Linux 13.37 x86_64 Slackware Linux 13.37 Slackware Linux 13.1 x86_64 Slackware Linux 13.1 Slackware Linux 13.0 x86_64 Slackware Linux 13.0 Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux -current Redhat Enterprise Linux Workstation Optional 6 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server Optional 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 6 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server Oracle Solaris 11.1 Oracle Enterprise Linux 5 Mandriva Linux Mandrake 2011 x86_64 Mandriva Linux Mandrake 2011 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 LibTIFF LibTIFF 4.0.3 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 5
Not Vulnerable:	Oracle Solaris 11.1.14.5.0

LibTIFF 'TIFFScanlineSize()' Function Heap-based Buffer Overflow Vulnerability

The LibTIFF is prone to a heap-based buffer overflow vulnerability because it fails to properly bounds check user-supplied data before copying it into an insufficiently sized buffer.

Successful exploits allow an attacker to execute arbitrary malicious code in the context of the application using the affected library. Failed exploit attempts will likely crash the application.

LibTIFF 4.0.3 is vulnerable; other versions may also be affected.

LibTIFF 'TIFFScanlineSize()' Function Heap-based Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

LibTIFF 'TIFFScanlineSize()' Function Heap-based Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Slackware Linux x86_64 -current

• Slackware libtiff-3.9.7-x86_64-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/ l/libtiff-3.9.7-x86_64-1.txz

Slackware Linux -current

• Slackware libtiff-3.9.7-i486-1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/l/li btiff-3.9.7-i486-1.txz

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva lib64tiff3-3.8.2-12.9mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64tiff3-devel-3.8.2-12.9mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64tiff3-static-devel-3.8.2-12.9mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libtiff-progs-3.8.2-12.9mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Slackware Linux 12.2

• Slackware libtiff-3.9.7-i486-1_slack12.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ libtiff-3.9.7-i486-1_slack12.2.tgz

Slackware Linux 14.0 x86_64

• Slackware libtiff-3.9.7-x86_64-1_slack14.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/package s/libtiff-3.9.7-x86_64-1_slack14.0.txz

MandrakeSoft Enterprise Server 5

• Mandriva libtiff-progs-3.8.2-12.9mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libtiff3-3.8.2-12.9mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libtiff3-devel-3.8.2-12.9mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libtiff3-static-devel-3.8.2-12.9mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/

Slackware Linux 13.1 x86_64

• Slackware libtiff-3.9.7-x86_64-1_slack13.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/package s/libtiff-3.9.7-x86_64-1_slack13.1.txz

Slackware Linux 13.1

• Slackware libtiff-3.9.7-i486-1_slack13.1.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/ libtiff-3.9.7-i486-1_slack13.1.txz

Slackware Linux 13.0 x86_64

• Slackware libtiff-3.9.7-x86_64-1_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/package s/libtiff-3.9.7-x86_64-1_slack13.0.txz

Slackware Linux 12.1

• Slackware libtiff-3.9.7-i486-1_slack12.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/ libtiff-3.9.7-i486-1_slack12.1.tgz

Slackware Linux 13.37 x86_64

• Slackware libtiff-3.9.7-x86_64-1_slack13.37.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packag es/libtiff-3.9.7-x86_64-1_slack13.37.txz

Slackware Linux 13.0

• Slackware libtiff-3.9.7-i486-1_slack13.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/ libtiff-3.9.7-i486-1_slack13.0.txz

Mandriva Linux Mandrake 2011 x86_64

• Mandriva lib64tiff-devel-3.9.5-1.4-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64tiff-static-devel-3.9.5-1.4-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64tiff3-3.9.5-1.4-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libtiff-progs-3.9.5-1.4-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Linux Mandrake 2011

• Mandriva libtiff-devel-3.9.5-1.4-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libtiff-progs-3.9.5-1.4-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libtiff-static-devel-3.9.5-1.4-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libtiff3-3.9.5-1.4-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Business Server 1 X86 64

• Mandriva lib64tiff-devel-4.0.1-3.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64tiff-static-devel-4.0.1-3.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64tiff5-4.0.1-3.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libtiff-progs-4.0.1-3.1.mbs1.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Slackware Linux 14.0

• Slackware libtiff-3.9.7-i486-1_slack14.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/ libtiff-3.9.7-i486-1_slack14.0.txz

Slackware Linux 13.37

• Slackware libtiff-3.9.7-i486-1_slack13.37.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages /libtiff-3.9.7-i486-1_slack13.37.txz

LibTIFF 'TIFFScanlineSize()' Function Heap-based Buffer Overflow Vulnerability

References:

• Bug 871700 - (CVE-2012-4564) libtiff: Missing return value check in ppm2tiff lea (Red Hat)
  
• CVE-2012-4564 Design Error vulnerability in GIMP (Oracle)
  
• CVE-2012-4564 Design Error vulnerability in LibTIFF (Oracle)
  
• LibTIFF Homepage (LibTIFF)