Bug 974840 - (CVE-2016-3658) VUL-1: CVE-2016-3658: tiff: Illegal read in TIFFWriteDirectoryTagLongLong8Array function in tiffset / tif_dirwrite.c
(CVE-2016-3658)
VUL-1: CVE-2016-3658: tiff: Illegal read in TIFFWriteDirectoryTagLongLong8Arr...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P4 - Low : Minor
: ---
Assigned To: Fridrich Strba
Security Team bot
https://smash.suse.de/issue/166960/
CVSSv2:RedHat:CVE-2016-3658:4.3:(AV:N...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2016-04-11 08:39 UTC by Johannes Segitz
Modified: 2017-01-08 00:18 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2016-04-11 08:39:35 UTC
Details
=======

Product: libtiff
Affected Versions: <= 4.0.6
Vulnerability Type: Illegel read
Vendor URL: http://www.remotesensing.org/libtiff/
CVE ID: CVE-2016-3658
Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360

Introduction

Illegal read occurs in the TIFFWriteDirectoryTagLongLong8Array function in tif_dirwrite.c when using tiffset command, which allows attackers to exploit this issue to cause denial-of-service.

/libtiff/tif_dirwrite.c: 1625
1623    for (q=p, ma=value, mb=0; mb<count; ma++, mb++, q++)
1624    {
1625        if (*ma>0xFFFFFFFF)
1626        {
1627            TIFFErrorExt(tif->tif_clientdata,module,
1628                         "Attempt to write value larger than 0xFFFFFFFF in Classic TIFF file.");
1629            _TIFFfree(p);
1630            return(0);
1631        }
1632        *q= (uint32)(*ma);
1633       }

gdb --args ./tiffset -s 300 296 poc.tif
����
Program received signal SIGSEGV, Segmentation fault.
TIFFWriteDirectoryTagLongLong8Array (tif=0x606010, ndir=0x7fffffffe1f0, dir=0x606560, tag=<optimized out>, count=1, value=0x0) at tif_dirwrite.c:1625
1625                 if (*ma>0xFFFFFFFF)
(gdb) bt
#0  TIFFWriteDirectoryTagLongLong8Array (tif=0x606010, ndir=0x7fffffffe1f0, dir=0x606560, tag=<optimized out>, count=1, value=0x0) at tif_dirwrite.c:1625
#1  0x00007ffff7abd867 in TIFFWriteDirectorySec (tif=0x606010, isimage=1, imagedone=1, pdiroff=0x0) at tif_dirwrite.c:550
#2  0x00007ffff7ad302c in TIFFRewriteDirectory (tif=tif@...ry=0x606010) at tif_dirwrite.c:359
#3  0x0000000000401a70 in main (argc=5, argv=<optimized out>) at tiffset.c:344
(gdb) l
1620                 return(0);
1621             }
1622
1623             for (q=p, ma=value, mb=0; mb<count; ma++, mb++, q++)
1624             {
1625                 if (*ma>0xFFFFFFFF)
1626                 {
1627                     TIFFErrorExt(tif->tif_clientdata,module,
1628                                  "Attempt to write value larger than 0xFFFFFFFF in Classic TIFF file.");
1629                     _TIFFfree(p);
(gdb) p ma
$1 = (uint64 *) 0x0


References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3658
http://people.canonical.com/~ubuntu-security/cve/2016/CVE-2016-3658.html
http://www.openwall.com/lists/oss-security/2016/04/08/12
Comment 1 Swamp Workflow Management 2016-04-11 22:00:29 UTC
bugbot adjusting priority
Comment 3 Alexander Bergmann 2016-11-23 16:19:54 UTC
It looks like only SLE-12 and openSUSE Leap is affected by this. The function TIFFWriteDirectoryTagLongLong8Array does not exist in version 3.8.2. There is only a TIFFWriteDirectory function inside libtiff/tif_dirwrite.c.
Comment 4 Alexander Bergmann 2016-11-23 16:25:15 UTC
It looks like upstream marked this as duplicate. (reproducers available)

http://bugzilla.maptools.org/show_bug.cgi?id=2500

Upstream Fix:
https://github.com/vadz/libtiff/commit/45c68450bef8ad876f310b495165c513cad8b67d
Comment 5 Swamp Workflow Management 2016-12-07 14:10:27 UTC
openSUSE-SU-2016:3035-1: An update that fixes 14 vulnerabilities is now available.

Category: security (important)
Bug References: 1007280,1010161,1010163,1011103,1011107,914890,974449,974840,984813,984815,987351
CVE References: CVE-2014-8127,CVE-2015-7554,CVE-2015-8665,CVE-2015-8683,CVE-2016-3622,CVE-2016-3658,CVE-2016-5321,CVE-2016-5323,CVE-2016-5652,CVE-2016-5875,CVE-2016-9273,CVE-2016-9297,CVE-2016-9448,CVE-2016-9453
Sources used:
openSUSE 13.2 (src):    tiff-4.0.7-10.35.1
Comment 6 Swamp Workflow Management 2016-12-29 23:17:11 UTC
SUSE-SU-2016:3301-1: An update that fixes 11 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1007280,1010161,1010163,1011103,1011107,914890,974449,974840,984813,984815,987351
CVE References: CVE-2014-8127,CVE-2016-3622,CVE-2016-3658,CVE-2016-5321,CVE-2016-5323,CVE-2016-5652,CVE-2016-5875,CVE-2016-9273,CVE-2016-9297,CVE-2016-9448,CVE-2016-9453
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    tiff-4.0.7-35.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    tiff-4.0.7-35.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    tiff-4.0.7-35.1
SUSE Linux Enterprise Server 12-SP2 (src):    tiff-4.0.7-35.1
SUSE Linux Enterprise Server 12-SP1 (src):    tiff-4.0.7-35.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    tiff-4.0.7-35.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    tiff-4.0.7-35.1
Comment 7 Andreas Stieger 2017-01-07 20:37:11 UTC
release for openSUSE, all done
Comment 8 Swamp Workflow Management 2017-01-08 00:18:20 UTC
openSUSE-SU-2017:0074-1: An update that fixes 11 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1007280,1010161,1010163,1011103,1011107,914890,974449,974840,984813,984815,987351
CVE References: CVE-2014-8127,CVE-2016-3622,CVE-2016-3658,CVE-2016-5321,CVE-2016-5323,CVE-2016-5652,CVE-2016-5875,CVE-2016-9273,CVE-2016-9297,CVE-2016-9448,CVE-2016-9453
Sources used:
openSUSE Leap 42.2 (src):    tiff-4.0.7-12.1
openSUSE Leap 42.1 (src):    tiff-4.0.7-12.1