Return-Path: <tiff-bounces@lists.maptools.org>
Delivered-To: info@awaresystems.be
Received: (qmail 4637 invoked from network); 31 Aug 2008 15:22:19 -0000
Received: from janet.telenet-ops.be ([195.130.136.6])
          (envelope-sender <tiff-bounces@lists.maptools.org>)
          by angelia.telenet-ops.be (qmail-ldap-1.03) with SMTP
          for <info@awaresystems.be>; 31 Aug 2008 15:22:19 -0000
Received: from vijay.telenet-ops.be (vijay.telenet-ops.be [195.130.136.9])
	by janet.telenet-ops.be (8.13.1/8.13.1) with ESMTP id m7VFMJbr013837
	for <info@awaresystems.be>; Sun, 31 Aug 2008 17:22:19 +0200
Received: from localhost (localhost.localdomain [127.0.0.1])
	by vijay.telenet-ops.be (Postfix) with SMTP id 5071E60006
	for <info@awaresystems.be>; Sun, 31 Aug 2008 17:22:19 +0200 (CEST)
Received: from circe.telenet-ops.be (circe.telenet-ops.be [195.130.132.51])
	by vijay.telenet-ops.be (Postfix) with ESMTP id 48D1560005
	for <info@awaresystems.be>; Sun, 31 Aug 2008 17:22:19 +0200 (CEST)
Received: from duke.maptools.org (r153.dmsolutions.ca [209.217.116.153])
	by circe.telenet-ops.be (Postfix) with ESMTP id DABC433E6A
	for <info@awaresystems.be>; Sun, 31 Aug 2008 17:22:18 +0200 (CEST)
Received: from duke.maptools.org (duke.maptools.org [127.0.0.1])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id m7VFI1ud003099;
	Sun, 31 Aug 2008 11:19:54 -0400
Received: from sasl.smtp.pobox.com (a-sasl-fastnet.sasl.smtp.pobox.com
	[207.106.133.19])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id m7VFHw5A003096
	for <tiff@lists.maptools.org>; Sun, 31 Aug 2008 11:17:58 -0400
Received: from localhost.localdomain (localhost [127.0.0.1])
	by a-sasl-fastnet.sasl.smtp.pobox.com (Postfix) with ESMTP id
	7FE7F54155; Sun, 31 Aug 2008 11:17:57 -0400 (EDT)
Received: from [192.168.2.4] (dpc674728121.direcpc.com [67.47.28.121]) (using
	TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client
	certificate
	requested) by a-sasl-fastnet.sasl.smtp.pobox.com (Postfix) with ESMTPSA
	id AA9E354154; Sun, 31 Aug 2008 11:17:50 -0400 (EDT)
Message-ID: <48BAB60F.7040207@pobox.com>
Date: Sun, 31 Aug 2008 11:17:35 -0400
From: Frank Warmerdam <warmerdam@pobox.com>
User-Agent: Thunderbird 2.0.0.6 (X11/20071022)
MIME-Version: 1.0
To: Even Rouault <even.rouault@mines-paris.org>
Subject: Re: [Tiff] Some security fixes from RHEL
References: <200808300053.35585.even.rouault@mines-paris.org>
In-Reply-To: <200808300053.35585.even.rouault@mines-paris.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-Pobox-Relay-ID: FDDBBB54-776F-11DD-8D2C-9EE598D589B0-06493634!a-sasl-fastnet.pobox.com
Cc: tiff@lists.maptools.org
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.4
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org
X-SpamCatcher-Score: 50 [XX]

Even Rouault wrote:
> I've just read http://lwn.net/Articles/296197 and I downloaded the source rpm.
> 
> I've attached here 2 vendor security patches from Redhat for their RHELs that 
> aren't yet applied to CVS head (I haven't check for 3.9 branch) :
> - libtiff-3.8.2-CVE-2006-2193.patch
> - libtiff-3.8.2-lzw-bugs.patch: Fixes for CVE-2008-2327. Partly reported and 
> proposed patch in http://bugzilla.maptools.org/show_bug.cgi?id=1929. But 
> Redhat's patch has a few extra lines. See 
> https://bugzilla.redhat.com/show_bug.cgi?id=458674
> 
> I'm just curious about how vendors usually interact with libtiff upstream 
> team ? It would have been nice if they had dropped a word on it on libtiff 
> bugzilla...

Even,

I was originally contact by someone from Apple a couple weeks ago, who offered
advance information in return for an agreement to embargo any disclosure
till the publication date.  I agreed, but in fact never got around to further
reviewing the matter even now with the date gone by.

Honestly, I think libtiff has lots of security issues in the fact of hostile
TIFF files, and I find it hard to get excited about any particular issue.

Also, apparently security folks don't like filing visible bugs on these
sorts of issues which makes it even harder for me to cope with since my
email folder is a black hole.

Best regards,
-- 
---------------------------------------+--------------------------------------
I set the clouds in motion - turn up   | Frank Warmerdam, warmerdam@pobox.com
light and sound - activate the windows | http://pobox.com/~warmerdam
and watch the world go round - Rush    | Geospatial Programmer for Rent

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
