Return-Path: <awaresystems.be+caf_=filtered=awaresystems.be@gmail.com>
Delivered-To: filtered@awaresystems.be
Received: from mx-x.one.com (mx-x.one.com [195.47.247.149])
	by mail6.local (Postfix) with ESMTP id 2520A8014FADD
	for <filtered@awaresystems.be>; Thu,  1 Aug 2013 11:28:14 +0200 (CEST)
X-Virus-Scanned: by one.com
X-Amavis-Alert: BAD HEADER SECTION, Duplicate header field: "MIME-Version"
Received-SPF: pass (mx-x: domain of awaresystems.be+caf_=filtered=awaresystems.be@gmail.com designates 209.85.215.53 as permitted sender)
X-Greylist: whitelisted by SQLgrey-1.8.0-rc2
Received: from mail-la0-f53.google.com (mail-la0-f53.google.com [209.85.215.53])
	by mx-x.one.com (Postfix) with ESMTP id 7EA4A7832E
	for <filtered@awaresystems.be>; Thu,  1 Aug 2013 09:25:56 +0000 (UTC)
Received: by mail-la0-f53.google.com with SMTP id el20so1235951lab.40
        for <filtered@awaresystems.be>; Thu, 01 Aug 2013 02:28:13 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=google.com; s=20120113;
        h=x-forwarded-to:x-forwarded-for:delivered-to:domainkey-status
         :x-gmail-fetch-info:delivered-to:x-virus-scanned:x-amavis-alert
         :x-greylist:mime-version:in-reply-to:references:date:message-id:from
         :to:subject:x-beenthere:x-mailman-version:precedence:list-id
         :list-unsubscribe:list-archive:list-post:list-help:list-subscribe
         :content-type:mime-version:sender:errors-to;
        bh=f4gWKw+m4KRgbeNkqUwyVCcgI8Be7vpXVpQ5O4pt7Rk=;
        b=GcJK1oRqV2T1x2scnYqbxzKvqVcP/keApO0TlKMgxvUF6vaSDmU/OfxvDTIgk85eHv
         owFghwUcwko5Gd4wprr3cnNccjYJnqH0oTxCzmPuYtqkkaiFtDU4RRPSKz23QfS41goy
         glg7RyfszSa1CZKtcYZoZQyjmxWOf2JbmBJs2X93ziOHdVtWxpitfNChcJ7cFk/Q629s
         rXNRKvG8cqHNEC6om24hWPf0ORoZvWeppZQGR6BBnc8914B8oWk7HwhC9b4/mlsXptan
         0aiLY3K1thaz26YFLibBNZW+AnGcmDNFP+lPRyxV2iNJxtFIvbjOKpk8Z4Rl2GaVdrWp
         cUyg==
X-Received: by 10.112.169.5 with SMTP id aa5mr911216lbc.71.1375349293326;
        Thu, 01 Aug 2013 02:28:13 -0700 (PDT)
X-Forwarded-To: filtered@awaresystems.be
X-Forwarded-For: awaresystems.be@gmail.com filtered@awaresystems.be
Delivered-To: awaresystems.be@gmail.com
Received: by 10.114.93.232 with SMTP id cx8csp236957ldb;
        Thu, 1 Aug 2013 02:28:12 -0700 (PDT)
X-Received: by 10.112.162.131 with SMTP id ya3mr896108lbb.85.1375349291945;
        Thu, 01 Aug 2013 02:28:11 -0700 (PDT)
DomainKey-Status: bad format
Received-SPF: neutral (google.com: 91.198.169.59 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) client-ip=91.198.169.59;
Received: by 10.112.34.176 with POP3 id a16mf1458958lbj.10;
        Thu, 01 Aug 2013 02:28:11 -0700 (PDT)
X-Gmail-Fetch-Info: info@awaresystems.be 1 pop.awaresystems.be 110 info@awaresystems.be
Delivered-To: info@awaresystems.be
Received: from mx-l.one.com (mx-l.one.com [91.198.169.59])
	by mail6.local (Postfix) with ESMTP id 814788014FADD
	for <info@awaresystems.be>; Thu,  1 Aug 2013 11:23:01 +0200 (CEST)
X-Amavis-Alert: BAD HEADER SECTION, Duplicate header field: "MIME-Version"
X-Greylist: domain auto-whitelisted by SQLgrey-1.8.0-rc2
Received: from lists.maptools.org (ks365428.kimsufi.com [94.23.4.142])
	by mx-l.one.com (Postfix) with ESMTP id C2878101769
	for <info@awaresystems.be>; Thu,  1 Aug 2013 10:01:59 +0000 (UTC)
Received: from [10.1.0.241] (localhost.localdomain [127.0.0.1])
	by lists.maptools.org (Postfix) with ESMTP id D01A935C02C;
	Thu,  1 Aug 2013 04:22:09 -0500 (EST)
Received: from mail-ve0-f174.google.com (mail-ve0-f174.google.com
	[209.85.128.174])
	by lists.maptools.org (Postfix) with ESMTPS id 3086835C02C
	for <tiff@lists.maptools.org>; Thu,  1 Aug 2013 04:21:10 -0500 (EST)
Received: by mail-ve0-f174.google.com with SMTP id d10so1969037vea.5
	for <tiff@lists.maptools.org>; Thu, 01 Aug 2013 02:21:09 -0700 (PDT)
MIME-Version: 1.0
X-Received: by 10.52.163.71 with SMTP id yg7mr124444vdb.110.1375348869313;
	Thu, 01 Aug 2013 02:21:09 -0700 (PDT)
Received: by 10.220.25.10 with HTTP; Thu, 1 Aug 2013 02:21:09 -0700 (PDT)
Received: by 10.220.25.10 with HTTP; Thu, 1 Aug 2013 02:21:09 -0700 (PDT)
In-Reply-To: <CAEDdjHdjO-Y+bf57V0AWVSu6xoeSH7aeY4-f4C7dsujgTPPoww@mail.gmail.com>
References: <CAEDdjHdjO-Y+bf57V0AWVSu6xoeSH7aeY4-f4C7dsujgTPPoww@mail.gmail.com>
Date: Thu, 1 Aug 2013 10:21:09 +0100
Message-ID: <CAEDdjHdLCRxZC6JrAK_8m0PXqBV_HgQoqFu7mkGEZVt5Q1w=3A@mail.gmail.com>
From: Pedro Ribeiro <pedrib@gmail.com>
To: "tiff@lists.maptools.org" <tiff@lists.maptools.org>
Subject: [Tiff] Vulnerabilities in libtiff 4.0.3
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Content-Type: multipart/mixed; boundary="===============1076947360=="
Mime-version: 1.0
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

--===============1076947360==
Content-Type: multipart/alternative; boundary=001a11c2c01acc4dab04e2df5c34

--001a11c2c01acc4dab04e2df5c34
Content-Type: text/plain; charset=ISO-8859-1

Hi,

I have discovered a few security vulnerabilities in libtiff. Some of them
are critical, but they are all in the tools section of the library.
The report below should be self explanatory, but I am happy to help with
interpreting it or providing advice on how to fix it if needed.
If you do update the library based on this information, please give credit
to Pedro Ribeiro (pedrib@gmail.com).

Regards
Pedro

Issue: Buffer overflow
Impact:Critical
Exploitability:Easy
File: tiff-4.0.3/tools/gif2tiff.c
Line: 316
Code snippet:
void
readextension(void)
{
    int count;
    char buf[255];

    (void) getc(infile);
    while ((count = getc(infile)))
        fread(buf, 1, count, infile);
}
Justification:
buffer is 256 bytes, but uses getc to get user input. Easy to exploit.

=========================================================
Issue: Buffer overflow (memory corruption)
Impact:Critical
Exploitability:Medium
File: tiff-4.0.3/tools/gif2tiff.c
Line: 343-344
Code snippet:
    unsigned char buf[255];
    register int bits=0;
    register unsigned long datum=0;
    register unsigned char *ch;
    register int count, code;
    int status = 1;

    datasize = getc(infile);
    clear = 1 << datasize;
    eoi = clear + 1;
    avail = clear + 2;
    oldcode = -1;
    codesize = datasize + 1;
    codemask = (1 << codesize) - 1;
    for (code = 0; code < clear; code++) {
prefix[code] = 0;
suffix[code] = code;
Justification:
buf is 255 but datasize is read from file input. If a crafted file provides
a datasize of 22, clear will be 4194304 (1 << 22). This means that a big
chunk of memory will become corrupted.

=========================================================
Issue: Buffer overflow
Impact:Critical
Exploitability:Easy
File: tiff-4.0.3/tools/gif2tiff.c
Line: 348
Code snippet:
    for (count = getc(infile); count > 0; count = getc(infile)) {
fread(buf,1,count,infile);
Justification:
buf is 255 but function reads count and input from user. Easy to exploit.

=========================================================
Issue: Use after free
Impact:High
Exploitability:Undetermined
File: tiff-4.0.3/tools/tiff2pdf.c
Line: 2469
Code snippet:
if(samplebuffer==NULL){
TIFFError(TIFF2PDF_MODULE,
"Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s",
(unsigned long) t2p->tiff_datasize,
TIFFFileName(input));
t2p->t2p_error = T2P_ERR_ERROR;
  _TIFFfree(buffer);
} else {
buffer=samplebuffer;
t2p->tiff_datasize *= t2p->tiff_samplesperpixel;
}
t2p_sample_realize_palette(t2p, buffer);

Justification:
If samplebuffer is NULL, buffer will be freed. However at the end of the if
statement, buffer is used again.

=========================================================
Issue: Buffer overflow
Impact:High
Exploitability:Undetermined
File: tiff-4.0.3/tools/rgb2ycbcr.c
Line: 335
Code snippet:
{ char buf[2048];
  char *cp = strrchr(TIFFFileName(in), '/');
  sprintf(buf, "YCbCr conversion of %s", cp ? cp+1 : TIFFFileName(in));
  TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, buf);
}
Justification:
Use of sprintf to write into a 2048 character buffer. The input is the
filename, which might be over 2048 if crafted by a malicious user. However
I could not determine this as the code is not easy to navigate.

--001a11c2c01acc4dab04e2df5c34
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

<p>Hi,</p>
<p>I have discovered a few security vulnerabilities in libtiff. Some of the=
m are critical, but they are all in the tools section of the library.<br>
The report below should be self explanatory, but I am happy to help with in=
terpreting it or providing advice on how to fix it if needed.<br>
If you do update the library based on this information, please give credit =
to Pedro Ribeiro (<a href=3D"mailto:pedrib@gmail.com">pedrib@gmail.com</a>)=
.</p>
<p>Regards<br>
Pedro</p>
<p>Issue: Buffer overflow<br>
Impact:Critical<br>
Exploitability:Easy<br>
File: tiff-4.0.3/tools/gif2tiff.c<br>
Line: 316<br>
Code snippet:<br>
void<br>
readextension(void)<br>
{<br>
=A0=A0=A0 int count;<br>
=A0=A0=A0 char buf[255];</p>
<p>=A0=A0=A0 (void) getc(infile);<br>
=A0=A0=A0 while ((count =3D getc(infile)))<br>
=A0=A0=A0=A0=A0=A0=A0 fread(buf, 1, count, infile);<br>
}<br>
Justification:<br>
buffer is 256 bytes, but uses getc to get user input. Easy to exploit.</p>
<p>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D<br>
Issue: Buffer overflow (memory corruption)<br>
Impact:Critical<br>
Exploitability:Medium<br>
File: tiff-4.0.3/tools/gif2tiff.c<br>
Line: 343-344<br>
Code snippet:<br>
=A0=A0=A0 unsigned char buf[255];<br>
=A0=A0=A0 register int bits=3D0;<br>
=A0=A0=A0 register unsigned long datum=3D0;<br>
=A0=A0=A0 register unsigned char *ch;<br>
=A0=A0=A0 register int count, code;<br>
=A0=A0=A0 int status =3D 1;</p>
<p>=A0=A0=A0 datasize =3D getc(infile);<br>
=A0=A0=A0 clear =3D 1 &lt;&lt; datasize;<br>
=A0=A0=A0 eoi =3D clear + 1;<br>
=A0=A0=A0 avail =3D clear + 2;<br>
=A0=A0=A0 oldcode =3D -1;<br>
=A0=A0=A0 codesize =3D datasize + 1;<br>
=A0=A0=A0 codemask =3D (1 &lt;&lt; codesize) - 1;<br>
=A0=A0=A0 for (code =3D 0; code &lt; clear; code++) {<br>
prefix[code] =3D 0;<br>
suffix[code] =3D code;<br>
Justification:<br>
buf is 255 but datasize is read from file input. If a crafted file provides=
 a datasize of 22, clear will be 4194304 (1 &lt;&lt; 22). This means that a=
 big chunk of memory will become corrupted.</p>
<p>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D<br>
Issue: Buffer overflow<br>
Impact:Critical<br>
Exploitability:Easy<br>
File: tiff-4.0.3/tools/gif2tiff.c<br>
Line: 348<br>
Code snippet:<br>
=A0=A0=A0 for (count =3D getc(infile); count &gt; 0; count =3D getc(infile)=
) {<br>
fread(buf,1,count,infile);<br>
Justification:<br>
buf is 255 but function reads count and input from user. Easy to exploit.</=
p>
<p>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D<br>
Issue: Use after free<br>
Impact:High<br>
Exploitability:Undetermined<br>
File: tiff-4.0.3/tools/tiff2pdf.c<br>
Line: 2469<br>
Code snippet:<br>
if(samplebuffer=3D=3DNULL){<br>
TIFFError(TIFF2PDF_MODULE, <br>
&quot;Can&#39;t allocate %lu bytes of memory for t2p_readwrite_pdf_image, %=
s&quot;, <br>
(unsigned long) t2p-&gt;tiff_datasize, <br>
TIFFFileName(input));<br>
t2p-&gt;t2p_error =3D T2P_ERR_ERROR;<br>
=A0 _TIFFfree(buffer);<br>
} else {<br>
buffer=3Dsamplebuffer;<br>
t2p-&gt;tiff_datasize *=3D t2p-&gt;tiff_samplesperpixel;<br>
}<br>
t2p_sample_realize_palette(t2p, buffer);</p>
<p>Justification:<br>
If samplebuffer is NULL, buffer will be freed. However at the end of the if=
 statement, buffer is used again.</p>
<p>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D<br>
Issue: Buffer overflow<br>
Impact:High<br>
Exploitability:Undetermined<br>
File: tiff-4.0.3/tools/rgb2ycbcr.c<br>
Line: 335<br>
Code snippet:<br>
{ char buf[2048];<br>
=A0 char *cp =3D strrchr(TIFFFileName(in), &#39;/&#39;);<br>
=A0 sprintf(buf, &quot;YCbCr conversion of %s&quot;, cp ? cp+1 : TIFFFileNa=
me(in));<br>
=A0 TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, buf);<br>
}<br>
Justification:<br>
Use of sprintf to write into a 2048 character buffer. The input is the file=
name, which might be over 2048 if crafted by a malicious user. However I co=
uld not determine this as the code is not easy to navigate.</p>

--001a11c2c01acc4dab04e2df5c34--

--===============1076947360==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
--===============1076947360==--
