Return-Path: <tiff-bounces@lists.maptools.org>
Delivered-To: info@awaresystems.be
Received: (qmail 24437 invoked from network); 31 Aug 2008 21:54:00 -0000
Received: from cliffy.telenet-ops.be ([195.130.136.2])
          (envelope-sender <tiff-bounces@lists.maptools.org>)
          by angelia.telenet-ops.be (qmail-ldap-1.03) with SMTP
          for <info@awaresystems.be>; 31 Aug 2008 21:54:00 -0000
Received: from waldo.telenet-ops.be (waldo.telenet-ops.be [195.130.136.10])
	by cliffy.telenet-ops.be (8.13.1/8.13.1) with ESMTP id m7VLrxn2001673
	for <info@awaresystems.be>; Sun, 31 Aug 2008 23:53:59 +0200
Received: from localhost (localhost.localdomain [127.0.0.1])
	by waldo.telenet-ops.be (Postfix) with SMTP id E343F1C00B
	for <info@awaresystems.be>; Sun, 31 Aug 2008 23:53:59 +0200 (CEST)
Received: from ladon.telenet-ops.be (ladon.telenet-ops.be [195.130.132.50])
	by waldo.telenet-ops.be (Postfix) with ESMTP id DD8A51C00A
	for <info@awaresystems.be>; Sun, 31 Aug 2008 23:53:59 +0200 (CEST)
Received: from duke.maptools.org (r153.dmsolutions.ca [209.217.116.153])
	by ladon.telenet-ops.be (Postfix) with ESMTP id 977D4312777
	for <info@awaresystems.be>; Sun, 31 Aug 2008 23:53:59 +0200 (CEST)
Received: from duke.maptools.org (duke.maptools.org [127.0.0.1])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id m7VLpq0b011757;
	Sun, 31 Aug 2008 17:53:09 -0400
Received: from scooby.simplesystems.org (scooby.simplesystems.org
	[65.66.246.67])
	by duke.maptools.org (8.12.11/8.12.10) with ESMTP id m7VLpnAw011753
	for <tiff@lists.maptools.org>; Sun, 31 Aug 2008 17:51:49 -0400
Received: from freddy.simplesystems.org (freddy.simplesystems.org
	[65.66.246.65])
	by scooby.simplesystems.org (8.12.10+Sun/8.12.10) with ESMTP id
	m7VLpiCI016376; Sun, 31 Aug 2008 16:51:44 -0500 (CDT)
Date: Sun, 31 Aug 2008 16:51:44 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@simple.dallas.tx.us>
X-X-Sender: bfriesen@freddy.simplesystems.org
To: Rogier Wolff <R.E.Wolff@bitwizard.nl>
Subject: Re: [Tiff] Some security fixes from RHEL
In-Reply-To: <20080831210931.GA5480@bitwizard.nl>
Message-ID: <Pine.SOC.4.64.0808311630310.1110@freddy.simplesystems.org>
References: <200808300053.35585.even.rouault@mines-paris.org>
	<48BAB60F.7040207@pobox.com>
	<Pine.SOC.4.64.0808311028060.1110@freddy.simplesystems.org>
	<20080831210931.GA5480@bitwizard.nl>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: tiff@lists.maptools.org
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.4
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org
X-SpamCatcher-Score: 10 [X]

On Sun, 31 Aug 2008, Rogier Wolff wrote:

> On Sun, Aug 31, 2008 at 10:38:01AM -0500, Bob Friesenhahn wrote:
>> If an application needs to be secure/stable in the face of hostile
>> files then it should not link against libtiff.
> end. Some malicious user might send invalid tiff files.

The programs you list: gqview, GIMP, ImageMagick, and Hylafax are not 
safe to use when faced with files from malicious users.  Even if the 
maintainers of these (huge) packages respond reasonably quickly and 
responsibly when they become aware of a security issue, you are 
severely mislead if you believe that this causes them to be secure. 
If you are running a server based on this complex software and it 
consumes files uploaded by potentially malicious users, then you 
should take precautions to prevent calamity if the software is 
convinced to something terribly wrong.  Likewise, end users should 
take care regarding files they open from people they don't already 
intend to trust.

> My system lists 199 packages as depending on libtiff. Over half cannot
> guarantee that they won't be run on data from the internet.
>
> For the record, I find your statement rediculous.

Unfortunate perhaps, but not rediculous.

The application I maintain (GraphicsMagick) already has an security 
exposure of over 1.1 million lines of code.  Modern ImageMagick likely 
doubles or quadruples this exposure.  Do you care to thoroughly 
inspect all of this code?

Bob
======================================
Bob Friesenhahn
bfriesen@simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
