Advisories

Mandriva Advisories

Package name libtiff Date August 1st, 2006 Advisory ID MDKSA-2006:137 Affected versions CS3.0, MNF2.0, 2006.0 Synopsis Updated libtiff packages fix multiple vulnerabilities

Problem Description

Tavis Ormandy, Google Security Team, discovered several vulnerabilites
the libtiff image processing library:

Several buffer overflows have been discovered, including a stack
buffer overflow via TIFFFetchShortPair() in tif_dirread.c, which is
used to read two unsigned shorts from the input file. While a bounds
check is performed via CheckDirCount(), no action is taken on the
result allowing a pathological tdir_count to read an arbitrary number
of unsigned shorts onto a stack buffer. (CVE-2006-3459)

A heap overflow vulnerability was discovered in the jpeg decoder,
where TIFFScanLineSize() is documented to return the size in bytes
that a subsequent call to TIFFReadScanline() would write, however the
encoded jpeg stream may disagree with these results and overrun the
buffer with more data than expected. (CVE-2006-3460)

Another heap overflow exists in the PixarLog decoder where a run
length encoded data stream may specify a stride that is not an exact
multiple of the number of samples. The result is that on the final
decode operation the destination buffer is overrun, potentially
allowing an attacker to execute arbitrary code. (CVE-2006-3461)

The NeXT RLE decoder was also vulnerable to a heap overflow
vulnerability, where no bounds checking was performed on the result of
certain RLE decoding operations. This was solved by ensuring the
number of pixels written did not exceed the size of the scanline
buffer already prepared. (CVE-2006-3462)

An infinite loop was discovered in EstimateStripByteCounts(), where a
16bit unsigned short was used to iterate over a 32bit unsigned value,
should the unsigned int (td_nstrips) have exceeded USHORT_MAX, the
loop would never terminate and continue forever. (CVE-2006-3463)

Multiple unchecked arithmetic operations were uncovered, including a
number of the range checking operations deisgned to ensure the offsets
specified in tiff directories are legitimate. These can be caused to
wrap for extreme values, bypassing sanity checks. Additionally, a
number of codepaths were uncovered where assertions did not hold true,
resulting in the client application calling abort(). (CVE-2006-3464)

A flaw was also uncovered in libtiffs custom tag support, as
documented here http://www.libtiff.org/v3.6.0.html. While well formed
tiff files must have correctly ordered directories, libtiff attempts
to support broken images that do not. However in certain
circumstances, creating anonymous fields prior to merging field
information from codec information can result in recognised fields
with unexpected values. This state results in abnormal behaviour,
crashes, or potentially arbitrary code execution. (CVE-2006-3465)

The updated packages have been patched to correct these issues.

Updated Packages

Corporate Server 3.0

 7ed65170763bdbb2db2c73a0e6d21dc5  corporate/3.0/RPMS/libtiff3-3.5.7-11.12.C30mdk.i586.rpm
 c4fd193c4ac3c199f98751b615f7f5ad  corporate/3.0/RPMS/libtiff3-devel-3.5.7-11.12.C30mdk.i586.rpm
 2d4920c58d576d4174358a62eb533acd  corporate/3.0/RPMS/libtiff3-static-devel-3.5.7-11.12.C30mdk.i586.rpm
 aa07135a25873d7265dfb1a4ac1fd365  corporate/3.0/RPMS/libtiff-progs-3.5.7-11.12.C30mdk.i586.rpm
 8c70315b6e8fcbfeb56abaf9df8fef52  corporate/3.0/SRPMS/libtiff-3.5.7-11.12.C30mdk.src.rpm

Corporate Server 3.0/X86_64

 c48326e5749da37145fe7744b2ec7da7  x86_64/corporate/3.0/RPMS/lib64tiff3-3.5.7-11.12.C30mdk.x86_64.rpm
 d5a2fa2ad3de5d7a77332920eea6ccb2  x86_64/corporate/3.0/RPMS/lib64tiff3-devel-3.5.7-11.12.C30mdk.x86_64.rpm
 3582b0f21935141f83bb83787ce6537a  x86_64/corporate/3.0/RPMS/lib64tiff3-static-devel-3.5.7-11.12.C30mdk.x86_64.rpm
 7ed65170763bdbb2db2c73a0e6d21dc5  x86_64/corporate/3.0/RPMS/libtiff3-3.5.7-11.12.C30mdk.i586.rpm
 b8de80aaa29a62815ef364357c319d95  x86_64/corporate/3.0/RPMS/libtiff-progs-3.5.7-11.12.C30mdk.x86_64.rpm
 8c70315b6e8fcbfeb56abaf9df8fef52  x86_64/corporate/3.0/SRPMS/libtiff-3.5.7-11.12.C30mdk.src.rpm

Multi Network Firewall 2.0

 8cc2951ca065dced86d900d2713f7755  mnf/2.0/RPMS/libtiff3-3.5.7-11.12.M20mdk.i586.rpm
 20c7813342fc7964cfc3f35465232ade  mnf/2.0/SRPMS/libtiff-3.5.7-11.12.M20mdk.src.rpm

Mandriva Linux 2006

 c0173eb2f2d497fce68b863a6d01433e  2006.0/RPMS/libtiff3-3.6.1-12.6.20060mdk.i586.rpm
 55369714ae92ea654507f33944285322  2006.0/RPMS/libtiff3-devel-3.6.1-12.6.20060mdk.i586.rpm
 8303a2a5f5b98d0fe984c4f62a8849e7  2006.0/RPMS/libtiff3-static-devel-3.6.1-12.6.20060mdk.i586.rpm
 898dbc11589b623cba53d4e0dea4ec6e  2006.0/RPMS/libtiff-progs-3.6.1-12.6.20060mdk.i586.rpm
 1f77f216c421961825035b17e2fc3d0f  2006.0/SRPMS/libtiff-3.6.1-12.6.20060mdk.src.rpm

Mandriva Linux 2006/X86_64

 67217a6617c35cfa110b9199ce827c7f  x86_64/2006.0/RPMS/lib64tiff3-3.6.1-12.6.20060mdk.x86_64.rpm
 b5ea6efd7fcb1db40c69457de4d90980  x86_64/2006.0/RPMS/lib64tiff3-devel-3.6.1-12.6.20060mdk.x86_64.rpm
 673437e87cd25febee28993cd3c9488d  x86_64/2006.0/RPMS/lib64tiff3-static-devel-3.6.1-12.6.20060mdk.x86_64.rpm
 c0173eb2f2d497fce68b863a6d01433e  x86_64/2006.0/RPMS/libtiff3-3.6.1-12.6.20060mdk.i586.rpm
 55369714ae92ea654507f33944285322  x86_64/2006.0/RPMS/libtiff3-devel-3.6.1-12.6.20060mdk.i586.rpm
 8303a2a5f5b98d0fe984c4f62a8849e7  x86_64/2006.0/RPMS/libtiff3-static-devel-3.6.1-12.6.20060mdk.i586.rpm
 c3a7a68b6fef5f74240a6f526412d216  x86_64/2006.0/RPMS/libtiff-progs-3.6.1-12.6.20060mdk.x86_64.rpm
 1f77f216c421961825035b17e2fc3d0f  x86_64/2006.0/SRPMS/libtiff-3.6.1-12.6.20060mdk.src.rpm

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3459
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3460
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3461
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3462
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3463
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3464
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3465

Upgrade

To upgrade automatically, use MandrivaUpdate.

Verification

Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :

                rpm --checksig package.rpm
                

You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.

If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.