Vulnerabilities > CVE-2006-2193 - Remote Buffer Overflow vulnerability in LibTIFF tiff2pdf

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
libtiff
nessus
NVD
Published: 2006-06-08
Updated: 2018-10-03

Summary

Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.

Vulnerable Configurations

Part Description Count
Application
Libtiff
40

Nessus

  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20080828_LIBTIFF_ON_SL3_X.NASL
    descriptionMultiple uses of uninitialized values were discovered in libtiff
    last seen2020-06-01
    modified2020-06-02
    plugin id60471
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60471
    titleScientific Linux Security Update : libtiff on SL3.x, SL4.x, SL5.x i386/x86_64
  • NASL familyMandriva Local Security Checks
    NASL idMANDRAKE_MDKSA-2006-102.NASL
    descriptionA buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in a sprintf call. Corporate Server 3 and Corporate Desktop 3 are not affected by this vulnerability as tiff2pdf was not part of the libtiff version shipped in those products. The updated packages have been patched to correct this issue.
    last seen2020-06-01
    modified2020-06-02
    plugin id21717
    published2006-06-16
    reporterThis script is Copyright (C) 2006-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/21717
    titleMandrake Linux Security Advisory : libtiff (MDKSA-2006:102)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2006-952.NASL
    description - Tue Sep 5 2006 Jindrich Novy <jnovy at redhat.com> - 3.8.2-1 - update to 3.8.2 - fix CVE-2006-2193, tiff2pdf buffer overflow (#194362) - fix typo in man page for tiffset (#186297) - use %{?dist}, fix Requires, BuildRoot - Mon Jul 24 2006 Matthias Clasen <mclasen at redhat.com> - Fix several vulnerabilities (CVE-2006-3460 CVE-2006-3461 CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id24175
    published2007-01-17
    reporterThis script is Copyright (C) 2007-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/24175
    titleFedora Core 5 : libtiff-3.8.2-1.fc5 (2006-952)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2008-0848.NASL
    descriptionUpdated libtiff packages that fix various security issues and a bug are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Multiple uses of uninitialized values were discovered in libtiff
    last seen2020-06-01
    modified2020-06-02
    plugin id34064
    published2008-08-30
    reporterThis script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34064
    titleRHEL 4 : libtiff (RHSA-2008:0848)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200607-03.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200607-03 (libTIFF: Multiple buffer overflows) A buffer overflow has been found in the t2p_write_pdf_string function in tiff2pdf, which can been triggered with a TIFF file containing a DocumentName tag with UTF-8 characters. An additional buffer overflow has been found in the handling of the parameters in tiffsplit. Impact : A remote attacker could entice a user to load a specially crafted TIFF file, resulting in the possible execution of arbitrary code. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id22010
    published2006-07-10
    reporterThis script is Copyright (C) 2006-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/22010
    titleGLSA-200607-03 : libTIFF: Multiple buffer overflows
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2008-0848.NASL
    descriptionUpdated libtiff packages that fix various security issues and a bug are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Multiple uses of uninitialized values were discovered in libtiff
    last seen2020-06-01
    modified2020-06-02
    plugin id67063
    published2013-06-29
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67063
    titleCentOS 4 : libtiff (CESA-2008:0848)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2008-0848.NASL
    descriptionFrom Red Hat Security Advisory 2008:0848 : Updated libtiff packages that fix various security issues and a bug are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Multiple uses of uninitialized values were discovered in libtiff
    last seen2020-06-01
    modified2020-06-02
    plugin id67740
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/67740
    titleOracle Linux 4 : libtiff (ELSA-2008-0848)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-1091.NASL
    descriptionSeveral problems have been discovered in the TIFF library. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2006-2193 SuSE discovered a buffer overflow in the conversion of TIFF files into PDF documents which could be exploited when tiff2pdf is used e.g. in a printer filter. - CVE-2006-2656 The tiffsplit command from the TIFF library contains a buffer overflow in the commandline handling which could be exploited when the program is executed automatically on unknown filenames.
    last seen2020-06-01
    modified2020-06-02
    plugin id22633
    published2006-10-14
    reporterThis script is Copyright (C) 2006-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/22633
    titleDebian DSA-1091-1 : tiff - buffer overflows
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-289-1.NASL
    descriptionA buffer overflow has been found in the tiff2pdf utility. By tricking an user into processing a specially crafted TIF file with tiff2pdf, this could potentially be exploited to execute arbitrary code with the privileges of the user. (CVE-2006-2193) A. Alejandro Hernandez discovered a buffer overflow in the tiffsplit utility. By calling tiffsplit with specially crafted long arguments, an user can execute arbitrary code. If tiffsplit is used in e. g. a web-based frontend or similar automated system, this could lead to remote arbitary code execution with the privileges of that system. (In normal interactive command line usage this is not a vulnerability.) (CVE-2006-2656). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id27861
    published2007-11-10
    reporterUbuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/27861
    titleUbuntu 5.04 / 5.10 / 6.06 LTS : tiff vulnerabilities (USN-289-1)

Oval

accepted2013-04-29T04:22:14.282-04:00
classvulnerability
contributors
  • nameAharon Chernin
    organizationSCAP.com, LLC
  • nameDragos Prisaca
    organizationG2, Inc.
definition_extensions
  • commentThe operating system installed on the system is Red Hat Enterprise Linux 4
    ovaloval:org.mitre.oval:def:11831
  • commentCentOS Linux 4.x
    ovaloval:org.mitre.oval:def:16636
  • commentOracle Linux 4.x
    ovaloval:org.mitre.oval:def:15990
descriptionBuffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.
familyunix
idoval:org.mitre.oval:def:9788
statusaccepted
submitted2010-07-09T03:56:16-04:00
titleBuffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.
version26

Redhat

advisories
rhsa
idRHSA-2008:0848
rpms
  • libtiff-0:3.6.1-12.el4_7.2
  • libtiff-debuginfo-0:3.6.1-12.el4_7.2
  • libtiff-devel-0:3.6.1-12.el4_7.2

Statements

contributorMark J Cox
lastmodified2008-09-02
organizationRed Hat
statementThis issue does not affect Red Hat Enterprise Linux 2.1 and 3 This issue was addressed in Red Hat Enterprise Linux 4 via: https://rhn.redhat.com/errata/RHSA-2008-0848.html Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

References