LibTIFF 'DOTRANGE' Tags Handling Remote Buffer Overflow Vulnerability
BID:56715
Info
LibTIFF 'DOTRANGE' Tags Handling Remote Buffer Overflow Vulnerability
| Bugtraq ID: | 56715 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2012-5581 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 28 2012 12:00AM |
| Updated: | Apr 16 2015 05:46PM |
| Credit: | Huzaifa Sidhpurwala from Red Hat Security Response Team |
| Vulnerable: |
Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 RedHat Enterprise Linux Desktop Workstation 5 client Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Oracle Enterprise Linux 5 Mandriva Linux Mandrake 2011 x86_64 Mandriva Linux Mandrake 2011 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 LibTIFF LibTIFF 4.0 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 5 |
| Not Vulnerable: | |
Discussion
LibTIFF 'DOTRANGE' Tags Handling Remote Buffer Overflow Vulnerability
LibTIFF is prone to a stack-based buffer-overflow vulnerability because it fails to properly bounds check user-supplied data before copying it into an insufficiently sized buffer.
Successful exploits allow an attacker to execute arbitrary malicious code in the context of the application using the affected library. Failed exploit attempts will likely crash the application.
This issue is fixed in LibTIFF 4.0.2.
LibTIFF is prone to a stack-based buffer-overflow vulnerability because it fails to properly bounds check user-supplied data before copying it into an insufficiently sized buffer.
Successful exploits allow an attacker to execute arbitrary malicious code in the context of the application using the affected library. Failed exploit attempts will likely crash the application.
This issue is fixed in LibTIFF 4.0.2.
Exploit / POC
LibTIFF 'DOTRANGE' Tags Handling Remote Buffer Overflow Vulnerability
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
LibTIFF 'DOTRANGE' Tags Handling Remote Buffer Overflow Vulnerability
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
LibTIFF 'DOTRANGE' Tags Handling Remote Buffer Overflow Vulnerability
References:
References:
- LibTIFF Homepage (LibTIFF)