Return-Path: <awaresystems.be+caf_=filtered=awaresystems.be@gmail.com>
Delivered-To: filtered@awaresystems.be
Received: from mx-x.one.com (mx-x.one.com [195.47.247.149])
	by mail6.local (Postfix) with ESMTP id E5ECF8014FAE2
	for <filtered@awaresystems.be>; Fri, 20 Sep 2013 18:14:59 +0200 (CEST)
X-Virus-Scanned: by one.com
Received-SPF: pass (mx-x: domain of awaresystems.be+caf_=filtered=awaresystems.be@gmail.com designates 209.85.217.182 as permitted sender)
X-Greylist: whitelisted by SQLgrey-1.8.0-rc2
Received: from mail-lb0-f182.google.com (mail-lb0-f182.google.com [209.85.217.182])
	by mx-x.one.com (Postfix) with ESMTP id E06B412E29B
	for <filtered@awaresystems.be>; Fri, 20 Sep 2013 16:14:57 +0000 (UTC)
Received: by mail-lb0-f182.google.com with SMTP id c11so720727lbj.13
        for <filtered@awaresystems.be>; Fri, 20 Sep 2013 09:14:59 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20130820;
        h=delivered-to:domainkey-status:delivered-to:message-id:date:from
         :user-agent:mime-version:to:references:in-reply-to:cc:subject
         :precedence:list-id:list-unsubscribe:list-archive:list-post
         :list-help:list-subscribe:content-type:content-transfer-encoding
         :sender:errors-to;
        bh=yvQJM1u7Imy3QGLBh7ezoVztLJpV1v8yWsq+qG3DqJ0=;
        b=AwbZOezXdjySs5o69RmXM2KJ8hfH++QRGRnncwgw5c+HOFeUheoxk9nusRlI13w23H
         Cgo2AIDBRyQgsOf1Fnv3JvtadqaXqhBFdNYlkjc0bmh9/10fLKhRoQRT5ea7BFWFDVhT
         9sbyzMQOopcExxRrGEVs9+UnfGzJR3sUyrDkSSZGXwe+1DqeTIDvIbBgQMFcDeYLpQvg
         6XwjcIGKDM9Q5HvpZS3yJVrxX0CpLV/+MvlH98e1jgT1wsZ9yWiVU/OPSeYurS+xWaUB
         k2+nttooX6/CoCVG+PEOBg5Hig/INGWR490j2lojp+ZIlB8XhRMjoa5zCNjz/PDBr0rS
         Vq2w==
X-Received: by 10.152.88.74 with SMTP id be10mr6847269lab.4.1379693699106;
        Fri, 20 Sep 2013 09:14:59 -0700 (PDT)
X-Forwarded-To: filtered@awaresystems.be
X-Forwarded-For: awaresystems.be@gmail.com filtered@awaresystems.be
Delivered-To: awaresystems.be@gmail.com
Received: by 10.114.2.237 with SMTP id 13csp21273ldx;
        Fri, 20 Sep 2013 09:14:58 -0700 (PDT)
X-Received: by 10.112.0.242 with SMTP id 18mr6901666lbh.18.1379693697608;
        Fri, 20 Sep 2013 09:14:57 -0700 (PDT)
DomainKey-Status: bad format
Received-SPF: neutral (google.com: 91.198.169.55 is neither permitted nor denied by best guess record for domain of tiff-bounces@lists.maptools.org) client-ip=91.198.169.55;
Received: by 10.152.99.180 with POP3 id er20mf268543lab.22;
        Fri, 20 Sep 2013 09:14:57 -0700 (PDT)
X-Gmail-Fetch-Info: info@awaresystems.be 1 pop.awaresystems.be 110 info@awaresystems.be
Delivered-To: info@awaresystems.be
Received: from mx-h.one.com (mx-h.one.com [91.198.169.55])
	by mail6.local (Postfix) with ESMTP id 368E98014FAE2
	for <info@awaresystems.be>; Fri, 20 Sep 2013 18:10:56 +0200 (CEST)
X-Greylist: domain auto-whitelisted by SQLgrey-1.8.0-rc2
Received: from lists.maptools.org (ks365428.kimsufi.com [94.23.4.142])
	by mx-h.one.com (Postfix) with ESMTP id 066FE356DEA
	for <info@awaresystems.be>; Fri, 20 Sep 2013 16:10:55 +0000 (UTC)
Received: from [10.1.0.241] (localhost.localdomain [127.0.0.1])
	by lists.maptools.org (Postfix) with ESMTP id B1B4635C029;
	Fri, 20 Sep 2013 11:10:19 -0500 (EST)
Received: from mail.howardsilvan.com (fangorn.howardsilvan.com
	[216.235.106.115])
	by lists.maptools.org (Postfix) with ESMTPS id 31B8335C029
	for <tiff@lists.maptools.org>; Fri, 20 Sep 2013 11:09:33 -0500 (EST)
Received: from fangorn.howardsilvan.com (localhost [127.0.0.1])
	by mail.howardsilvan.com (Postfix) with ESMTPA id DFBF7C42127;
	Fri, 20 Sep 2013 09:09:29 -0700 (PDT)
Received: from bilbo.x101.com ([64.146.212.27] helo=bilbo.x101.com) with
	IPv4:225 by fangorn.howardsilvan.com; 20 Sep 2013 09:09:08 -0700
Message-ID: <523C7322.4040803@howardsilvan.com>
Date: Fri, 20 Sep 2013 09:09:06 -0700
From: Lee Howard <faxguy@howardsilvan.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
	rv:17.0) Gecko/20130110 Thunderbird/17.0.2
MIME-Version: 1.0
To: Pedro Ribeiro <pedrib@gmail.com>
References: <CAEDdjHdjO-Y+bf57V0AWVSu6xoeSH7aeY4-f4C7dsujgTPPoww@mail.gmail.com>
	<CAEDdjHdLCRxZC6JrAK_8m0PXqBV_HgQoqFu7mkGEZVt5Q1w=3A@mail.gmail.com>
In-Reply-To: <CAEDdjHdLCRxZC6JrAK_8m0PXqBV_HgQoqFu7mkGEZVt5Q1w=3A@mail.gmail.com>
Cc: "tiff@lists.maptools.org" <tiff@lists.maptools.org>
Subject: Re: [Tiff] Vulnerabilities in libtiff 4.0.3
X-BeenThere: tiff@lists.maptools.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: TIFF and libtiff discussion <tiff.lists.maptools.org>
List-Unsubscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=unsubscribe>
List-Archive: <http://lists.maptools.org/mailman/private/tiff>
List-Post: <mailto:tiff@lists.maptools.org>
List-Help: <mailto:tiff-request@lists.maptools.org?subject=help>
List-Subscribe: <http://lists.maptools.org/mailman/listinfo/tiff>,
	<mailto:tiff-request@lists.maptools.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: tiff-bounces@lists.maptools.org
Errors-To: tiff-bounces@lists.maptools.org

On 08/01/2013 02:21 AM, Pedro Ribeiro wrote:
>
> Hi,
>
> I have discovered a few security vulnerabilities in libtiff. Some of 
> them are critical, but they are all in the tools section of the library.
> The report below should be self explanatory, but I am happy to help 
> with interpreting it or providing advice on how to fix it if needed.
> If you do update the library based on this information, please give 
> credit to Pedro Ribeiro (pedrib@gmail.com <mailto:pedrib@gmail.com>).
>
> Regards
> Pedro
>
> Issue: Buffer overflow
> Impact:Critical
> Exploitability:Easy
> File: tiff-4.0.3/tools/gif2tiff.c
> Line: 316
> Code snippet:
> void
> readextension(void)
> {
>     int count;
>     char buf[255];
>
>     (void) getc(infile);
>     while ((count = getc(infile)))
>         fread(buf, 1, count, infile);
> }
> Justification:
> buffer is 256 bytes, but uses getc to get user input. Easy to exploit.
>

I've addressed this in CVS by changing the while() statement to:

     while ((count = getc(infile)) && count <= 255)

> =========================================================
> Issue: Buffer overflow (memory corruption)
> Impact:Critical
> Exploitability:Medium
> File: tiff-4.0.3/tools/gif2tiff.c
> Line: 343-344
> Code snippet:
>     unsigned char buf[255];
>     register int bits=0;
>     register unsigned long datum=0;
>     register unsigned char *ch;
>     register int count, code;
>     int status = 1;
>
>     datasize = getc(infile);
>     clear = 1 << datasize;
>     eoi = clear + 1;
>     avail = clear + 2;
>     oldcode = -1;
>     codesize = datasize + 1;
>     codemask = (1 << codesize) - 1;
>     for (code = 0; code < clear; code++) {
> prefix[code] = 0;
> suffix[code] = code;
> Justification:
> buf is 255 but datasize is read from file input. If a crafted file 
> provides a datasize of 22, clear will be 4194304 (1 << 22). This means 
> that a big chunk of memory will become corrupted.
>

This appears to be resolved already as the code in CVS now says this:

     datasize = getc(infile);
     if (datasize > 12)
         return 0;

> =========================================================
> Issue: Buffer overflow
> Impact:Critical
> Exploitability:Easy
> File: tiff-4.0.3/tools/gif2tiff.c
> Line: 348
> Code snippet:
>     for (count = getc(infile); count > 0; count = getc(infile)) {
> fread(buf,1,count,infile);
> Justification:
> buf is 255 but function reads count and input from user. Easy to exploit.
>

I've addressed this in CVS by changing the for() statement to:

     for (count = getc(infile); count > 0 && count <= 255; count = 
getc(infile)) {

> =========================================================
> Issue: Use after free
> Impact:High
> Exploitability:Undetermined
> File: tiff-4.0.3/tools/tiff2pdf.c
> Line: 2469
> Code snippet:
> if(samplebuffer==NULL){
> TIFFError(TIFF2PDF_MODULE,
> "Can't allocate %lu bytes of memory for t2p_readwrite_pdf_image, %s",
> (unsigned long) t2p->tiff_datasize,
> TIFFFileName(input));
> t2p->t2p_error = T2P_ERR_ERROR;
>   _TIFFfree(buffer);
> } else {
> buffer=samplebuffer;
> t2p->tiff_datasize *= t2p->tiff_samplesperpixel;
> }
> t2p_sample_realize_palette(t2p, buffer);
>
> Justification:
> If samplebuffer is NULL, buffer will be freed. However at the end of 
> the if statement, buffer is used again.
>

This appears to be resolved already in CVS since the code now says this:

                                 _TIFFfree(buffer);
                                    return(0);

> =========================================================
> Issue: Buffer overflow
> Impact:High
> Exploitability:Undetermined
> File: tiff-4.0.3/tools/rgb2ycbcr.c
> Line: 335
> Code snippet:
> { char buf[2048];
>   char *cp = strrchr(TIFFFileName(in), '/');
>   sprintf(buf, "YCbCr conversion of %s", cp ? cp+1 : TIFFFileName(in));
>   TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, buf);
> }
> Justification:
> Use of sprintf to write into a 2048 character buffer. The input is the 
> filename, which might be over 2048 if crafted by a malicious user. 
> However I could not determine this as the code is not easy to navigate.
>

This appears to be resolved already in CVS since the code now uses 
snprintf() instead of sprintf():

           snprintf(buf, sizeof(buf), "YCbCr conversion of %s",

Thanks,

Lee.

_______________________________________________
Tiff mailing list: Tiff@lists.maptools.org
http://lists.maptools.org/mailman/listinfo/tiff
http://www.remotesensing.org/libtiff/
