OSVDB ID: 84090

Title: LibTIFF tools/tiff2pdf.c t2p_read_tiff_init() Function T2P Struct Pointer TIFF Image Handling Overflow

Info

Disclosure
Jul 19, 2012

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Jul 18, 2012

Description

 LibTIFF is prone to an overflow condition. The t2p_read_tiff_init() function in tools/tiff2pdf.c fails to properly sanitize user-supplied input resulting in a heap-based buffer overflow. With a specially crafted T2p struct pointer in a TIFF image, a remote attacker can potentially execute arbitrary code.

Classification

 Location: Context Dependent
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Patch / RCS, Upgrade
Exploit: Exploit Unknown
Disclosure: Vendor Verified

Solution

 Upgrade to version 3.9.7, 4.0.3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

libtiff.org

libtiff

 4.0.2
3.9.1
3.9.2
3.9.3
3.9.4
3.9.5
3.9.6
4.0.0
4.0.1

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/84090