Vulnerabilities > CVE-2004-1308 - Unspecified vulnerability in Libtiff
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN libtiff
nessus
Summary
Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 10 |
Nessus
NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2005-019.NASL description Updated libtiff packages that fix various integer overflows are now available. The libtiff package contains a library of functions for manipulating TIFF (Tagged Image File Format) image format files. iDEFENSE has reported an integer overflow bug that affects libtiff. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause the application linked to libtiff to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1308 to this issue. Dmitry V. Levin reported another integer overflow in the tiffdump utility. An attacker who has the ability to trick a user into opening a malicious TIFF file with tiffdump could possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1183 to this issue. All users are advised to upgrade to these updated packages, which contain backported fixes for these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 16159 published 2005-01-13 reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/16159 title RHEL 2.1 / 3 : libtiff (RHSA-2005:019) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Red Hat Security Advisory RHSA-2005:019. The text # itself is copyright (C) Red Hat, Inc. # include("compat.inc"); if (description) { script_id(16159); script_version ("1.25"); script_cvs_date("Date: 2019/10/25 13:36:10"); script_cve_id("CVE-2004-1183", "CVE-2004-1308"); script_xref(name:"RHSA", value:"2005:019"); script_name(english:"RHEL 2.1 / 3 : libtiff (RHSA-2005:019)"); script_summary(english:"Checks the rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote Red Hat host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "Updated libtiff packages that fix various integer overflows are now available. The libtiff package contains a library of functions for manipulating TIFF (Tagged Image File Format) image format files. iDEFENSE has reported an integer overflow bug that affects libtiff. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause the application linked to libtiff to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1308 to this issue. Dmitry V. Levin reported another integer overflow in the tiffdump utility. An attacker who has the ability to trick a user into opening a malicious TIFF file with tiffdump could possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1183 to this issue. All users are advised to upgrade to these updated packages, which contain backported fixes for these issues." ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2004-1183" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/security/cve/cve-2004-1308" ); script_set_attribute( attribute:"see_also", value:"https://access.redhat.com/errata/RHSA-2005:019" ); script_set_attribute( attribute:"solution", value:"Update the affected libtiff and / or libtiff-devel packages." ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libtiff"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:libtiff-devel"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:2.1"); script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:3"); script_set_attribute(attribute:"vuln_publication_date", value:"2005/01/06"); script_set_attribute(attribute:"patch_publication_date", value:"2005/01/13"); script_set_attribute(attribute:"plugin_publication_date", value:"2005/01/13"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Red Hat Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat"); os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat"); os_ver = os_ver[1]; if (! preg(pattern:"^(2\.1|3)([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 2.1 / 3.x", "Red Hat " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu); yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo"); if (!empty_or_null(yum_updateinfo)) { rhsa = "RHSA-2005:019"; yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa); if (!empty_or_null(yum_report)) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : yum_report ); exit(0); } else { audit_message = "affected by Red Hat security advisory " + rhsa; audit(AUDIT_OS_NOT, audit_message); } } else { flag = 0; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"libtiff-3.5.5-19")) flag++; if (rpm_check(release:"RHEL2.1", cpu:"i386", reference:"libtiff-devel-3.5.5-19")) flag++; if (rpm_check(release:"RHEL3", reference:"libtiff-3.5.7-22.el3")) flag++; if (rpm_check(release:"RHEL3", reference:"libtiff-devel-3.5.7-22.el3")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_HOLE, extra : rpm_report_get() + redhat_report_package_caveat() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libtiff / libtiff-devel"); } }
NASL family Fedora Local Security Checks NASL id FEDORA_2004-576.NASL description Fix several buffer overflow problems that could be used as an exploit. Fixes the following security advisory: CVE-2004-1308 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 16032 published 2004-12-23 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/16032 title Fedora Core 2 : libtiff-3.5.7-21.fc2 (2004-576) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Fedora Security Advisory 2004-576. # include("compat.inc"); if (description) { script_id(16032); script_version ("1.16"); script_cvs_date("Date: 2019/08/02 13:32:23"); script_xref(name:"FEDORA", value:"2004-576"); script_name(english:"Fedora Core 2 : libtiff-3.5.7-21.fc2 (2004-576)"); script_summary(english:"Checks rpm output for the updated package."); script_set_attribute( attribute:"synopsis", value:"The remote Fedora Core host is missing a security update." ); script_set_attribute( attribute:"description", value: "Fix several buffer overflow problems that could be used as an exploit. Fixes the following security advisory: CVE-2004-1308 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); # https://lists.fedoraproject.org/pipermail/announce/2004-December/000531.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?39b43c61" ); script_set_attribute( attribute:"solution", value:"Update the affected libtiff package." ); script_set_attribute(attribute:"risk_factor", value:"High"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:libtiff"); script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora_core:2"); script_set_attribute(attribute:"patch_publication_date", value:"2004/12/22"); script_set_attribute(attribute:"plugin_publication_date", value:"2004/12/23"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2004-2019 Tenable Network Security, Inc."); script_family(english:"Fedora Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/RedHat/release"); if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora"); os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora"); os_ver = os_ver[1]; if (! ereg(pattern:"^2([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 2.x", "Fedora " + os_ver); if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu); flag = 0; if (rpm_check(release:"FC2", reference:"libtiff-3.5.7-21.fc2")) flag++; if (flag) { if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get()); else security_hole(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libtiff"); }
NASL family SuSE Local Security Checks NASL id SUSE_SA_2005_001.NASL description The remote host is missing the patch for the advisory SUSE-SA:2005:001 (libtiff/tiff). Libtiff supports reading, writing, and manipulating of TIFF image files. iDEFENSE reported an integer overflow in libtiff that can be exploited by specific TIFF images to trigger a heap-based buffer overflow afterwards. This bug can be used by external attackers to execute arbitrary code over the network by placing special image files on web-pages and alike. Additionally a buffer overflow in tiffdump was fixed. last seen 2020-06-01 modified 2020-06-02 plugin id 16305 published 2005-02-03 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/16305 title SUSE-SA:2005:001: libtiff/tiff code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # This plugin text was extracted from SuSE Security Advisory SUSE-SA:2005:001 # if ( ! defined_func("bn_random") ) exit(0); include("compat.inc"); if(description) { script_id(16305); script_version ("1.12"); script_cvs_date("Date: 2019/10/25 13:36:28"); script_cve_id("CVE-2004-1183", "CVE-2004-1308"); name["english"] = "SUSE-SA:2005:001: libtiff/tiff"; script_name(english:name["english"]); script_set_attribute(attribute:"synopsis", value: "The remote host is missing a vendor-supplied security patch" ); script_set_attribute(attribute:"description", value: "The remote host is missing the patch for the advisory SUSE-SA:2005:001 (libtiff/tiff). Libtiff supports reading, writing, and manipulating of TIFF image files. iDEFENSE reported an integer overflow in libtiff that can be exploited by specific TIFF images to trigger a heap-based buffer overflow afterwards. This bug can be used by external attackers to execute arbitrary code over the network by placing special image files on web-pages and alike. Additionally a buffer overflow in tiffdump was fixed." ); script_set_attribute(attribute:"solution", value: "http://www.suse.de/security/advisories/2005_01_libtiff_tiff.html" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_attribute(attribute:"plugin_publication_date", value: "2005/02/03"); script_end_attributes(); summary["english"] = "Check for the version of the libtiff/tiff package"; script_summary(english:summary["english"]); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2005-2019 Tenable Network Security, Inc."); family["english"] = "SuSE Local Security Checks"; script_family(english:family["english"]); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/SuSE/rpm-list"); exit(0); } include("rpm.inc"); if ( rpm_check( reference:"libtiff-3.5.7-379", release:"SUSE8.1") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"tiff-3.5.7-379", release:"SUSE8.1") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"libtiff-3.5.7-379", release:"SUSE8.2") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"tiff-3.5.7-379", release:"SUSE8.2") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"libtiff-3.5.7-379", release:"SUSE9.0") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"tiff-3.5.7-379", release:"SUSE9.0") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"libtiff-3.6.1-38.14", release:"SUSE9.1") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"tiff-3.6.1-38.14", release:"SUSE9.1") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"libtiff-3.6.1-47.4", release:"SUSE9.2") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"libtiff-devel-3.6.1-47.4", release:"SUSE9.2") ) { security_hole(0); exit(0); } if ( rpm_check( reference:"tiff-3.6.1-47.4", release:"SUSE9.2") ) { security_hole(0); exit(0); } if (rpm_exists(rpm:"libtiff-", release:"SUSE8.1") || rpm_exists(rpm:"libtiff-", release:"SUSE8.2") || rpm_exists(rpm:"libtiff-", release:"SUSE9.0") || rpm_exists(rpm:"libtiff-", release:"SUSE9.1") || rpm_exists(rpm:"libtiff-", release:"SUSE9.2") ) { set_kb_item(name:"CVE-2004-1183", value:TRUE); set_kb_item(name:"CVE-2004-1308", value:TRUE); }
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200501-06.NASL description The remote host is affected by the vulnerability described in GLSA-200501-06 (tiff: New overflows in image decoding) infamous41md found a potential integer overflow in the directory entry count routines of the TIFF library (CAN-2004-1308). Dmitry V. Levin found another similar issue in the tiffdump utility (CAN-2004-1183). Impact : A remote attacker could entice a user to view a carefully crafted TIFF image file, which would potentially lead to execution of arbitrary code with the rights of the user viewing the image. This affects any program that makes use of the TIFF library, including many web browsers or mail readers. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 16397 published 2005-02-14 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/16397 title GLSA-200501-06 : tiff: New overflows in image decoding NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2005-052.NASL description Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform. (formerly CVE-2004-0888). This also affects applications like kdegraphics, that use embedded versions of xpdf. (CVE-2005-0206) In addition, previous libtiff updates overlooked kdegraphics, which contains and embedded libtiff used for kfax. This update includes patches to address: CVE-2004-0803, CVE-2004-0804, CVE-2004-0886, CVE-2004-1183, CVE-2004-1308. The updated packages are patched to deal with these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 17281 published 2005-03-06 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/17281 title Mandrake Linux Security Advisory : kdegraphics (MDKSA-2005:052) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_FC7E6A42601211D9A9E70001020EED82.NASL description In an iDEFENSE Security Advisory infamous41md reports : Remote exploitation of a heap-based buffer overflow vulnerability within the LibTIFF package could allow attackers to execute arbitrary code. The vulnerability specifically exists due to insufficient validation of user-supplied data when calculating the size of a directory entry. A TIFF file includes a number of directory entry header fields that describe the data in the file. Included in these entries is an entry count and offset value that are calculated to determine the size and location of the data for that entry. last seen 2020-06-01 modified 2020-06-02 plugin id 19184 published 2005-07-13 reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/19184 title FreeBSD : tiff -- directory entry count integer overflow vulnerability (fc7e6a42-6012-11d9-a9e7-0001020eed82) NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2005-002.NASL description Several vulnerabilities have been discovered in the libtiff package; wxGTK2 uses a libtiff code tree, so it may have the same vulnerabilities : iDefense reported the possibility of remote exploitation of an integer overflow in libtiff that may allow for the execution of arbitrary code. The overflow occurs in the parsing of TIFF files set with the STRIPOFFSETS flag. iDefense also reported a heap-based buffer overflow vulnerability within the LibTIFF package could allow attackers to execute arbitrary code. (CVE-2004-1308) The vulnerability specifically exists due to insufficient validation of user-supplied data when calculating the size of a directory entry. The updated packages are patched to protect against these vulnerabilities. last seen 2020-06-01 modified 2020-06-02 plugin id 16115 published 2005-01-07 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/16115 title Mandrake Linux Security Advisory : wxGTK2 (MDKSA-2005:002) NASL family Fedora Local Security Checks NASL id FEDORA_2004-577.NASL description Fix several buffer overflow problems that could be used as an exploit. Fixes the following security advisory: CVE-2004-1308 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 16033 published 2004-12-23 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/16033 title Fedora Core 3 : libtiff-3.6.1-8.fc3 (2004-577) NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2005-005.NASL description The remote host is missing Security Update 2005-005. This security update contains fixes for the following applications : - Apache - AppKit - AppleScript - Bluetooth - Directory Services - Finder - Foundation - HelpViewer - LDAP - libXpm - lukemftpd - NetInfo - ServerAdmin - sudo - Terminal - VPN These programs have multiple vulnerabilities that could allow a remote attacker to execute arbitrary code. last seen 2020-06-01 modified 2020-06-02 plugin id 18189 published 2005-05-03 reporter This script is Copyright (C) 2005-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/18189 title Mac OS X Multiple Vulnerabilities (Security Update 2005-005) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2005-035.NASL description Updated libtiff packages that fix various integer overflows are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team The libtiff package contains a library of functions for manipulating TIFF (Tagged Image File Format) image format files. infamous41md discovered integer overflow flaws in libtiff. An attacker could create a carefully crafted TIFF file in such a way that it could cause an application linked with libtiff to overflow a heap buffer when the file was opened by a victim. Due to the nature of the overflow it is unlikely that it is possible to use this flaw to execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1308 to this issue. Dmitry V. Levin discovered an integer overflow flaw in libtiff. An attacker could create a carefully crafted TIFF file in such a way that it could cause an application linked with libtiff to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-1183 to this issue. All users are advised to upgrade to these updated packages, which contain backported fixes for these issues. last seen 2020-06-01 modified 2020-06-02 plugin id 17169 published 2005-02-22 reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/17169 title RHEL 4 : libtiff (RHSA-2005:035) NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2005-001.NASL description Several vulnerabilities have been discovered in the libtiff package : iDefense reported the possibility of remote exploitation of an integer overflow in libtiff that may allow for the execution of arbitrary code. The overflow occurs in the parsing of TIFF files set with the STRIPOFFSETS flag. iDefense also reported a heap-based buffer overflow vulnerability within the LibTIFF package could allow attackers to execute arbitrary code. (CVE-2004-1308) The vulnerability specifically exists due to insufficient validation of user-supplied data when calculating the size of a directory entry. The updated packages are patched to protect against these vulnerabilities. last seen 2020-06-01 modified 2020-06-02 plugin id 16114 published 2005-01-07 reporter This script is Copyright (C) 2005-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/16114 title Mandrake Linux Security Advisory : libtiff (MDKSA-2005:001) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2005-021.NASL description Updated kdegraphics packages that resolve multiple security issues in kfax are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team The kdegraphics package contains graphics applications for the K Desktop Environment. During a source code audit, Chris Evans discovered a number of integer overflow bugs that affect libtiff. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these bugs. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0886 and CVE-2004-0804 to these issues. Additionally, a number of buffer overflow bugs that affect libtiff have been found. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these bugs. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0803 to this issue. Users of kfax should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 18017 published 2005-04-12 reporter This script is Copyright (C) 2005-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/18017 title RHEL 2.1 / 3 : kdegraphics (RHSA-2005:021) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-46-1.NASL description A buffer overflow was discovered in the TIFF library. A TIFF file includes a value indicating the number of last seen 2020-06-01 modified 2020-06-02 plugin id 20663 published 2006-01-15 reporter Ubuntu Security Notice (C) 2004-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/20663 title Ubuntu 4.10 : tiff vulnerability (USN-46-1) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2005-021.NASL description Updated kdegraphics packages that resolve multiple security issues in kfax are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team The kdegraphics package contains graphics applications for the K Desktop Environment. During a source code audit, Chris Evans discovered a number of integer overflow bugs that affect libtiff. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these bugs. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0886 and CVE-2004-0804 to these issues. Additionally, a number of buffer overflow bugs that affect libtiff have been found. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these bugs. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0803 to this issue. Users of kfax should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 21795 published 2006-07-03 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/21795 title CentOS 3 : kdegraphics (CESA-2005:021) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-617.NASL description 'infamous41md last seen 2020-06-01 modified 2020-06-02 plugin id 16048 published 2004-12-27 reporter This script is Copyright (C) 2004-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/16048 title Debian DSA-617-1 : tiff - insufficient input validation
Oval
accepted 2005-11-16T08:02:00.000-04:00 class vulnerability contributors name Robert L. Hollis organization ThreatGuard, Inc. description Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow. family unix id oval:org.mitre.oval:def:100117 status accepted submitted 2005-08-16T12:00:00.000-04:00 title libtiff Directory Entry Count Integer Overflow Vulnerability version 36 accepted 2013-04-29T04:19:07.964-04:00 class vulnerability contributors name Aharon Chernin organization SCAP.com, LLC name Dragos Prisaca organization G2, Inc.
definition_extensions comment The operating system installed on the system is Red Hat Enterprise Linux 3 oval oval:org.mitre.oval:def:11782 comment CentOS Linux 3.x oval oval:org.mitre.oval:def:16651 comment The operating system installed on the system is Red Hat Enterprise Linux 4 oval oval:org.mitre.oval:def:11831 comment CentOS Linux 4.x oval oval:org.mitre.oval:def:16636 comment Oracle Linux 4.x oval oval:org.mitre.oval:def:15990
description Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow. family unix id oval:org.mitre.oval:def:9392 status accepted submitted 2010-07-09T03:56:16-04:00 title Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow. version 26
Redhat
advisories |
| ||||||||
rpms |
|
Related news
References
- http://www.idefense.com/application/poi/display?id=174&type=vulnerabilities
- http://www.debian.org/security/2004/dsa-617
- http://www.redhat.com/support/errata/RHSA-2005-019.html
- http://www.redhat.com/support/errata/RHSA-2005-035.html
- http://www.novell.com/linux/security/advisories/2005_01_libtiff_tiff.html
- http://www.kb.cert.org/vuls/id/125598
- http://lists.apple.com/archives/security-announce/2005/May/msg00001.html
- http://www.us-cert.gov/cas/techalerts/TA05-136A.html
- http://secunia.com/advisories/13776
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000920
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:052
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-201072-1
- https://exchange.xforce.ibmcloud.com/vulnerabilities/18637
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9392
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A100117