Vulnerabilities > CVE-2006-2193 - Unspecified vulnerability in Libtiff
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN libtiff
nessus
Summary
Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.
Vulnerable Configurations
Nessus
NASL family Scientific Linux Local Security Checks NASL id SL_20080828_LIBTIFF_ON_SL3_X.NASL description Multiple uses of uninitialized values were discovered in libtiff last seen 2020-06-01 modified 2020-06-02 plugin id 60471 published 2012-08-01 reporter This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/60471 title Scientific Linux Security Update : libtiff on SL3.x, SL4.x, SL5.x i386/x86_64 NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2006-102.NASL description A buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in a sprintf call. Corporate Server 3 and Corporate Desktop 3 are not affected by this vulnerability as tiff2pdf was not part of the libtiff version shipped in those products. The updated packages have been patched to correct this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 21717 published 2006-06-16 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/21717 title Mandrake Linux Security Advisory : libtiff (MDKSA-2006:102) NASL family Fedora Local Security Checks NASL id FEDORA_2006-952.NASL description - Tue Sep 5 2006 Jindrich Novy <jnovy at redhat.com> - 3.8.2-1 - update to 3.8.2 - fix CVE-2006-2193, tiff2pdf buffer overflow (#194362) - fix typo in man page for tiffset (#186297) - use %{?dist}, fix Requires, BuildRoot - Mon Jul 24 2006 Matthias Clasen <mclasen at redhat.com> - Fix several vulnerabilities (CVE-2006-3460 CVE-2006-3461 CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 24175 published 2007-01-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/24175 title Fedora Core 5 : libtiff-3.8.2-1.fc5 (2006-952) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2008-0848.NASL description Updated libtiff packages that fix various security issues and a bug are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Multiple uses of uninitialized values were discovered in libtiff last seen 2020-06-01 modified 2020-06-02 plugin id 34064 published 2008-08-30 reporter This script is Copyright (C) 2008-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34064 title RHEL 4 : libtiff (RHSA-2008:0848) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-200607-03.NASL description The remote host is affected by the vulnerability described in GLSA-200607-03 (libTIFF: Multiple buffer overflows) A buffer overflow has been found in the t2p_write_pdf_string function in tiff2pdf, which can been triggered with a TIFF file containing a DocumentName tag with UTF-8 characters. An additional buffer overflow has been found in the handling of the parameters in tiffsplit. Impact : A remote attacker could entice a user to load a specially crafted TIFF file, resulting in the possible execution of arbitrary code. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 22010 published 2006-07-10 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22010 title GLSA-200607-03 : libTIFF: Multiple buffer overflows NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2008-0848.NASL description Updated libtiff packages that fix various security issues and a bug are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Multiple uses of uninitialized values were discovered in libtiff last seen 2020-06-01 modified 2020-06-02 plugin id 67063 published 2013-06-29 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67063 title CentOS 4 : libtiff (CESA-2008:0848) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2008-0848.NASL description From Red Hat Security Advisory 2008:0848 : Updated libtiff packages that fix various security issues and a bug are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Multiple uses of uninitialized values were discovered in libtiff last seen 2020-06-01 modified 2020-06-02 plugin id 67740 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67740 title Oracle Linux 4 : libtiff (ELSA-2008-0848) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-1091.NASL description Several problems have been discovered in the TIFF library. The Common Vulnerabilities and Exposures project identifies the following issues : - CVE-2006-2193 SuSE discovered a buffer overflow in the conversion of TIFF files into PDF documents which could be exploited when tiff2pdf is used e.g. in a printer filter. - CVE-2006-2656 The tiffsplit command from the TIFF library contains a buffer overflow in the commandline handling which could be exploited when the program is executed automatically on unknown filenames. last seen 2020-06-01 modified 2020-06-02 plugin id 22633 published 2006-10-14 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22633 title Debian DSA-1091-1 : tiff - buffer overflows NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-289-1.NASL description A buffer overflow has been found in the tiff2pdf utility. By tricking an user into processing a specially crafted TIF file with tiff2pdf, this could potentially be exploited to execute arbitrary code with the privileges of the user. (CVE-2006-2193) A. Alejandro Hernandez discovered a buffer overflow in the tiffsplit utility. By calling tiffsplit with specially crafted long arguments, an user can execute arbitrary code. If tiffsplit is used in e. g. a web-based frontend or similar automated system, this could lead to remote arbitary code execution with the privileges of that system. (In normal interactive command line usage this is not a vulnerability.) (CVE-2006-2656). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 27861 published 2007-11-10 reporter Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/27861 title Ubuntu 5.04 / 5.10 / 6.06 LTS : tiff vulnerabilities (USN-289-1)
Oval
| accepted | 2013-04-29T04:22:14.282-04:00 | ||||||||||||
| class | vulnerability | ||||||||||||
| contributors |
| ||||||||||||
| definition_extensions |
| ||||||||||||
| description | Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call. | ||||||||||||
| family | unix | ||||||||||||
| id | oval:org.mitre.oval:def:9788 | ||||||||||||
| status | accepted | ||||||||||||
| submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||
| title | Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call. | ||||||||||||
| version | 26 |
Redhat
| advisories |
| ||||
| rpms |
|
Statements
| contributor | Mark J Cox |
| lastmodified | 2008-09-02 |
| organization | Red Hat |
| statement | This issue does not affect Red Hat Enterprise Linux 2.1 and 3 This issue was addressed in Red Hat Enterprise Linux 4 via: https://rhn.redhat.com/errata/RHSA-2008-0848.html Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch. |
References
- http://bugzilla.remotesensing.org/show_bug.cgi?id=1196
- http://www.debian.org/security/2006/dsa-1091
- http://secunia.com/advisories/20488
- http://secunia.com/advisories/20501
- http://secunia.com/advisories/20520
- http://www.securityfocus.com/bid/18331
- http://secunia.com/advisories/20693
- http://lists.suse.com/archive/suse-security-announce/2006-Jun/0008.html
- http://secunia.com/advisories/20766
- http://security.gentoo.org/glsa/glsa-200607-03.xml
- http://secunia.com/advisories/21002
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:102
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-103160-1
- http://secunia.com/advisories/27181
- http://secunia.com/advisories/27222
- http://secunia.com/advisories/27832
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-201331-1
- http://www.redhat.com/support/errata/RHSA-2008-0848.html
- http://secunia.com/advisories/31670
- http://www.vupen.com/english/advisories/2007/4034
- http://www.vupen.com/english/advisories/2006/2197
- http://www.vupen.com/english/advisories/2007/3486
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=370355
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26991
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9788
- https://usn.ubuntu.com/289-1/