Bug 974840 (CVE-2016-3658)

Summary: VUL-1: CVE-2016-3658: tiff: Illegal read in TIFFWriteDirectoryTagLongLong8Array function in tiffset / tif_dirwrite.c
Product: [Novell Products] SUSE Security Incidents Reporter: Johannes Segitz <jsegitz>
Component: IncidentsAssignee: Fridrich Strba <fstrba>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Minor    
Priority: P4 - Low CC: abergmann, astieger, meissner, smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/166960/
Whiteboard: CVSSv2:RedHat:CVE-2016-3658:4.3:(AV:N/AC:M/Au:N/C:N/I:N/A:P) CVSSv2:SUSE:CVE-2016-3658:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P) CVSSv2:NVD:CVE-2016-3658:5.0:(AV:N/AC:L/Au:N/C:N/I:N/A:P)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Johannes Segitz 2016-04-11 08:39:35 UTC
Details
=======

Product: libtiff
Affected Versions: <= 4.0.6
Vulnerability Type: Illegel read
Vendor URL: http://www.remotesensing.org/libtiff/
CVE ID: CVE-2016-3658
Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360

Introduction

Illegal read occurs in the TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c when using tiffset command, which allows attackers to exploit this issue to cause denial-of-service.

/libtiff/tif_dirwrite.c: 1625
1623    for (q=p, ma=value, mb=0; mb<count; ma++, mb++, q++)
1624    {
1625        if (*ma>0xFFFFFFFF)
1626        {
1627            TIFFErrorExt(tif->tif_clientdata,module,
1628                         "Attempt to write value larger than 0xFFFFFFFF in Classic TIFF file.");
1629            _TIFFfree(p);
1630            return(0);
1631        }
1632        *q= (uint32)(*ma);
1633       }

gdb --args ./tiffset -s 300 296 poc.tif
����
Program received signal SIGSEGV, Segmentation fault.
TIFFWriteDirectoryTagLongLong8Array (tif=0x606010, ndir=0x7fffffffe1f0, dir=0x606560, tag=<optimized out>, count=1, value=0x0) at tif_dirwrite.c:1625
1625                 if (*ma>0xFFFFFFFF)
(gdb) bt
#0  TIFFWriteDirectoryTagLongLong8Array (tif=0x606010, ndir=0x7fffffffe1f0, dir=0x606560, tag=<optimized out>, count=1, value=0x0) at tif_dirwrite.c:1625
#1  0x00007ffff7abd867 in TIFFWriteDirectorySec (tif=0x606010, isimage=1, imagedone=1, pdiroff=0x0) at tif_dirwrite.c:550
#2  0x00007ffff7ad302c in TIFFRewriteDirectory (tif=tif@...ry=0x606010) at tif_dirwrite.c:359
#3  0x0000000000401a70 in main (argc=5, argv=<optimized out>) at tiffset.c:344
(gdb) l
1620                 return(0);
1621             }
1622
1623             for (q=p, ma=value, mb=0; mb<count; ma++, mb++, q++)
1624             {
1625                 if (*ma>0xFFFFFFFF)
1626                 {
1627                     TIFFErrorExt(tif->tif_clientdata,module,
1628                                  "Attempt to write value larger than 0xFFFFFFFF in Classic TIFF file.");
1629                     _TIFFfree(p);
(gdb) p ma
$1 = (uint64 *) 0x0


References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3658
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-3658.html
http://www.openwall.com/lists/oss-security/2016/04/08/12
Comment 1 Swamp Workflow Management 2016-04-11 22:00:29 UTC
bugbot adjusting priority
Comment 3 Alexander Bergmann 2016-11-23 16:19:54 UTC
It looks like only SLE-12 and openSUSE Leap is affected by this. The function TIFFWriteDirectoryTagLongLong8Array does not exist in version 3.8.2. There is only a TIFFWriteDirectory function inside libtiff/tif_dirwrite.c.
Comment 4 Alexander Bergmann 2016-11-23 16:25:15 UTC
It looks like upstream marked this as duplicate. (reproducers available)

http://bugzilla.maptools.org/show_bug.cgi?id=2500

Upstream Fix:
https://github.com/vadz/libtiff/commit/45c68450bef8ad876f310b495165c513cad8b67d
Comment 5 Swamp Workflow Management 2016-12-07 14:10:27 UTC
openSUSE-SU-2016:3035-1: An update that fixes 14 vulnerabilities is now available.

Category: security (important)
Bug References: 1007280,1010161,1010163,1011103,1011107,914890,974449,974840,984813,984815,987351
CVE References: CVE-2014-8127,CVE-2015-7554,CVE-2015-8665,CVE-2015-8683,CVE-2016-3622,CVE-2016-3658,CVE-2016-5321,CVE-2016-5323,CVE-2016-5652,CVE-2016-5875,CVE-2016-9273,CVE-2016-9297,CVE-2016-9448,CVE-2016-9453
Sources used:
openSUSE 13.2 (src):    tiff-4.0.7-10.35.1
Comment 6 Swamp Workflow Management 2016-12-29 23:17:11 UTC
SUSE-SU-2016:3301-1: An update that fixes 11 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1007280,1010161,1010163,1011103,1011107,914890,974449,974840,984813,984815,987351
CVE References: CVE-2014-8127,CVE-2016-3622,CVE-2016-3658,CVE-2016-5321,CVE-2016-5323,CVE-2016-5652,CVE-2016-5875,CVE-2016-9273,CVE-2016-9297,CVE-2016-9448,CVE-2016-9453
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    tiff-4.0.7-35.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    tiff-4.0.7-35.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    tiff-4.0.7-35.1
SUSE Linux Enterprise Server 12-SP2 (src):    tiff-4.0.7-35.1
SUSE Linux Enterprise Server 12-SP1 (src):    tiff-4.0.7-35.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    tiff-4.0.7-35.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    tiff-4.0.7-35.1
Comment 7 Andreas Stieger 2017-01-07 20:37:11 UTC
release for openSUSE, all done
Comment 8 Swamp Workflow Management 2017-01-08 00:18:20 UTC
openSUSE-SU-2017:0074-1: An update that fixes 11 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1007280,1010161,1010163,1011103,1011107,914890,974449,974840,984813,984815,987351
CVE References: CVE-2014-8127,CVE-2016-3622,CVE-2016-3658,CVE-2016-5321,CVE-2016-5323,CVE-2016-5652,CVE-2016-5875,CVE-2016-9273,CVE-2016-9297,CVE-2016-9448,CVE-2016-9453
Sources used:
openSUSE Leap 42.2 (src):    tiff-4.0.7-12.1
openSUSE Leap 42.1 (src):    tiff-4.0.7-12.1