LibTIFF OJPEGVSetField heap overflow
| libtiff-ojpegvsetfield-bo (17843) |  High Risk |
Description:
LibTIFF is vulnerable to a heap overflow in the OJPEGVSetField function of the tif_ojpeg.c file. If the OJPEG_SUPPORT option is enabled, a remote attacker could create a malicious TIFF file to overflow a buffer and execute arbitrary code on the system, once the victim opens the malicious file.
Consequences:
Gain Access
Remedy:
For SuSE Linux:
Upgrade to the latest libtiff package, as listed below. Refer to SuSE Security Announcement SUSE-SA:2004:038 for more information. See References.
SuSE Linux 9.1: 3.6.1-38.12 or later
SuSE Linux 9.0, 8.2, and 8.1: 3.5.7-376 or later
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- BugTraq Mailing List, Fri Oct 22 2004 - 12:34:48 CDT: iDEFENSE Security Advisory XX.XX.04 - Novell SuSe Linux LibTIFF Heap Overflow Vulnerability.
- iDEFENSE Security Advisory 10.22.04: Novell SuSe Linux LibTIFF Heap Overflow Vulnerability.
- BID-11506: LibTIFF OJPEG Heap Buffer Overflow Vulnerability
- CVE-2004-0929: Heap-based buffer overflow in the OJPEGVSetField function in tif_ojpeg.c for libtiff 3.6.1 and earlier, when compiled with the OJPEG_SUPPORT (old JPEG support) option, allows remote attackers to execute arbitrary code via a malformed TIFF image.
- SUSE-SA:2004:038: libtiff: local privilege escalation
- US-CERT VU#129910: SuSe Linux LibTIFF package vulnerable to buffer overflow
Platforms Affected:
- Sam Leffler LibTIFF 3.6.1
- SuSE Linux Enterprise Server 8
- SUSE SuSE Linux 8.1
- SUSE SuSE Linux 8.2
- SUSE SuSE Linux 9.0
- SUSE SuSE Linux 9.1
- SuSE SuSE Linux Desktop 1.0
- SuSE SuSE SLES 9
Reported:
Oct 22, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net