[<prev] [next>] [day] [month] [year] [list]
Message-ID: <5EDB84F4B23F5B4DB6500A89258280E0B97383@EX02.corp.qihoo.net>
Date: Fri, 8 Apr 2016 07:16:12 +0000
From: 张开翔 <zhangkaixiang@....cn>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: CVE-2016-3658 - libtiff 4.0.6 illegel read
Details
=======
Product: libtiff
Affected Versions: <= 4.0.6
Vulnerability Type: Illegel read
Vendor URL: http://www.remotesensing.org/libtiff/
CVE ID: CVE-2016-3658
Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360
Introduction
Illegal read occurs in the TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c when using tiffset command, which allows attackers to exploit this issue to cause denial-of-service.
/libtiff/tif_dirwrite.c: 1625
1623 for (q=p, ma=value, mb=0; mb<count; ma++, mb++, q++)
1624 {
1625 if (*ma>0xFFFFFFFF)
1626 {
1627 TIFFErrorExt(tif->tif_clientdata,module,
1628 "Attempt to write value larger than 0xFFFFFFFF in Classic TIFF file.");
1629 _TIFFfree(p);
1630 return(0);
1631 }
1632 *q= (uint32)(*ma);
1633 }
gdb --args ./tiffset -s 300 296 poc.tif
……
Program received signal SIGSEGV, Segmentation fault.
TIFFWriteDirectoryTagLongLong8Array (tif=0x606010, ndir=0x7fffffffe1f0, dir=0x606560, tag=<optimized out>, count=1, value=0x0) at tif_dirwrite.c:1625
1625 if (*ma>0xFFFFFFFF)
(gdb) bt
#0 TIFFWriteDirectoryTagLongLong8Array (tif=0x606010, ndir=0x7fffffffe1f0, dir=0x606560, tag=<optimized out>, count=1, value=0x0) at tif_dirwrite.c:1625
#1 0x00007ffff7abd867 in TIFFWriteDirectorySec (tif=0x606010, isimage=1, imagedone=1, pdiroff=0x0) at tif_dirwrite.c:550
#2 0x00007ffff7ad302c in TIFFRewriteDirectory (tif=tif@...ry=0x606010) at tif_dirwrite.c:359
#3 0x0000000000401a70 in main (argc=5, argv=<optimized out>) at tiffset.c:344
(gdb) l
1620 return(0);
1621 }
1622
1623 for (q=p, ma=value, mb=0; mb<count; ma++, mb++, q++)
1624 {
1625 if (*ma>0xFFFFFFFF)
1626 {
1627 TIFFErrorExt(tif->tif_clientdata,module,
1628 "Attempt to write value larger than 0xFFFFFFFF in Classic TIFF file.");
1629 _TIFFfree(p);
(gdb) p ma
$1 = (uint64 *) 0x0
References:
[1] http://www.remotesensing.org/libtiff/
Thank you!
Best Regards,
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
