Return-Path: <tiff-bounces@lists.maptools.org>
Received: from inas024.isp.belgacom.be (localhost [127.0.0.1])
        by inav020.isp.belgacom.be (8.12.11/8.12.11/Skynet-IN-AV-3.00) with ESMTP id j8S5fkqp030633
        for <joris.at.lebbeke@skynet.be>; Wed, 28 Sep 2005 07:41:46 +0200
        (envelope-from <tiff-bounces@lists.maptools.org>)
Received: from inmx016.isp.belgacom.be (inmx016.isp.belgacom.be [195.238.2.219])
        by inas024.isp.belgacom.be (8.12.11/8.12.11/Skynet-IN-AS-2.03) with ESMTP id j8S5fg5X009801
        for <joris.at.lebbeke@skynet.be>; Wed, 28 Sep 2005 07:41:42 +0200
        (envelope-from <tiff-bounces@lists.maptools.org>)
Received: from duke.maptools.org (r153.dmsolutions.ca [209.217.116.153] (may be forged))
        by inmx016.isp.belgacom.be (8.12.11/8.12.11/Skynet-IN-2.32) with ESMTP id j8S5fZY6020244
        for <joris.at.lebbeke@skynet.be>; Wed, 28 Sep 2005 07:41:36 +0200
        (envelope-from <tiff-bounces@lists.maptools.org>)
Received: from duke.maptools.org (duke.maptools.org [127.0.0.1])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id j8S5b3gT031833;
	Wed, 28 Sep 2005 01:37:33 -0400
Received: from outfbmx009.isp.belgacom.be (outfbmx009.isp.belgacom.be
	[195.238.2.198])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id j8S5b0Bf031830
	for <tiff@lists.maptools.org>; Wed, 28 Sep 2005 01:37:01 -0400
Received: from outmx008.isp.belgacom.be (outmx008.isp.belgacom.be
	[195.238.3.235]) by outfbmx009.isp.belgacom.be
	(8.12.11/8.12.11/Skynet-OUT-FALLBACK-2.22) with ESMTP id
	j8S2L469022201
	for <tiff@lists.maptools.org>; Wed, 28 Sep 2005 04:21:04 +0200
	(envelope-from <joris.at.lebbeke@skynet.be>)
Received: from outmx008.isp.belgacom.be (localhost [127.0.0.1])
	by outmx008.isp.belgacom.be (8.12.11/8.12.11/Skynet-OUT-2.22) with
	ESMTP id j8S2Kqh7025244
	for <tiff@lists.maptools.org>; Wed, 28 Sep 2005 04:20:52 +0200
	(envelope-from <joris.at.lebbeke@skynet.be>)
Received: from dfgrrxsknr4e (5-190.245.81.adsl.skynet.be [81.245.190.5])
	by outmx008.isp.belgacom.be (8.12.11/8.12.11/Skynet-OUT-2.22) with SMTP
	id j8S2KkFq025211; Wed, 28 Sep 2005 04:20:46 +0200
	(envelope-from <joris.at.lebbeke@skynet.be>)
Message-ID: <000901c5c3d3$5dbf96c0$05bef551@dfgrrxsknr4e>
From: "Joris" <joris.at.lebbeke@skynet.be>
To: "Frank Warmerdam" <warmerdam@pobox.com>, "TIFF" <tiff@lists.maptools.org>
References: <931f8ea905092717492b79dca1@mail.gmail.com>
Subject: Re: [Tiff] PSP libtiff hack?
Date: Wed, 28 Sep 2005 04:21:37 +0200
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1506
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1506
Cc: 
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.4
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org
X-UIDL: 000000000023ceae.00000ca2
X-MSP-STORE: Wed, 28 Sep 2005 07:41:53 +0200
Status:   

Frank Warmerdam wrote:
> According to Slashdot a recent Sony PSP hack was accomplished
> using a vulnerability in libtiff (who knew libtiff was on the PSP?).

I read the same thing, and found it was all very weird... If only these
people spend as much time on actual good documentation and specification
of facts and exact vulnerability, as they do on fighting amongst
themselves in SMS type language of wannabee hackers, we'd have a chance
to know what is actually going on.

> The file is available at:
>
>   http://home.gdal.org/~warmerda/overflow.tif
>
> In case anyone wants to test TIFF applications with it.

Thanks!

I'm seeing a more or less regular IFD, all valid values, except for
BitsPerSample tag, which has 16496 SHORT values.

SamplesPerPixel is 3, which is slightly less. Judging from
StripByteCounts with no compression and Photometric, BitsPerSample
should be 8,8,8 to obtain a legit TIFF IFD.

But the actual BitsPerSample tag value, is 0,0,1, a handfull of 0's,
some actual data that seems to contain a filename, and another massive
load of 0's. So I'm guessing it's an overflow vulnerability in the
handling of the BitsPerSample tag that is being used. It is of course
entirely possible the vulnerability is already cured in current LibTiff,
the hackers were to busy discussing who's entitled to put up PayPal
stuff to be concerned with mentioning what version of LibTiff may be
envolved.

> What would be ideal is if one or more of these hardware makers
> using libtiff actually provided some funding for a detailed
> vulnerability analysis.  Then they (and we) wouldn't have egg on our
> faces.

Right on!


Joris Van Damme
info@awaresystems.be
http://www.awaresystems.be/
Download your free TIFF tag viewer for windows here:
http://www.awaresystems.be/imaging/tiff/astifftagviewer.html

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
