Detalji
Kreirano: 24 Rujan 2012
Pronađeni su i ispravljeni višestruki propusti paketa libTIFF koje je zlonamjerni korisnik mogao iskoristiti kako bi doveo do uskraćivanja usluge ili kako bi izveo proizvoljan programski kod.
Paket:
LibTIFF 3.x
Operacijski sustavi:
Gentoo Linux
Kritičnost:
6.8
Problem:
cjelobrojno prepisivanje, pogreška u programskoj funkciji, pogreška u programskoj komponenti, preljev međuspremnika
Iskorištavanje:
udaljeno
Posljedica:
proizvoljno izvršavanje programskog koda, uskraćivanje usluga (DoS)
Rješenje:
programska zakrpa proizvođača
CVE:
CVE-2009-2347, CVE-2009-5022, CVE-2010-1411, CVE-2010-2065, CVE-2010-2067, CVE-2010-2233, CVE-2010-2443, CVE-2010-2481, CVE-2010-2482, CVE-2010-2483, CVE-2010-2595, CVE-2010-2596, CVE-2010-2597, CVE-2010-2630, CVE-2010-2631, CVE-2010-3087, CVE-2010-4665
Izvorni ID preporuke:
GLSA 201209-02
Izvor:
Gentoo
Problem:
Problemi se javljaju zbog neispravnih funkcija ReadDirectory, TIFFReadDirectory, TIFFVStripSize, OJPEGPostDecode, TIFFYCbCrtoRGB, TIFFRGBAImageGet, OJPEGReadBufferFill, TIFFFetchSubjectDistance, Fax3SetupState, TIFFExtractData i TIFFroundup makro dijela funkcije te zbog nepravilnog rukovanja prilikom konverzije boja pojedinih datoteka i dekodiranja datoteka. Također, problemi se javljaju zbog neispravnog rukovanja td_stripbytecount poljem i prilikom vertikalnog prebacivanja slike.
Posljedica:
Zlonamjerni korisnik mogao je iskoristiti brojne propuste kako bi preljevanjem međuspremnika doveo do uskraćivanja usluge ili kako bi, podmetanjem posebno oblikovane datoteke, izveo proizvoljan programski kod.
Rješenje:
Objavljena je nadogradnja paketa koja se može slobodno preuzeti.
Izvorni tekst preporuke
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201209-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: libTIFF: Multiple vulnerabilities
Date: September 23, 2012
Bugs: #307001, #324885, #357271, #359871, #371308, #410931,
#422673, #427166
ID: 201209-02
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities in libTIFF could result in execution of
arbitrary code or Denial of Service.
Background
==========
libTIFF provides support for reading and manipulating TIFF (Tagged
Image File Format) images.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 media-libs/tiff < 4.0.2-r1 *>= 3.9.5-r2
>= 4.0.2-r1
Description
===========
Multiple vulnerabilities have been discovered in libTIFF. Please review
the CVE identifiers referenced below for details.
Impact
======
A remote attacker could entice a user to open a specially crafted TIFF
file with an application making use of libTIFF, possibly resulting in
execution of arbitrary code with the privileges of the user running the
application or a Denial of Service condition.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All libTIFF 4.0 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/tiff-4.0.2-r1"
All libTIFF 3.9 users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-libs/tiff-3.9.5-r2"
References
==========
[ 1 ] CVE-2009-2347
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-2347
[ 2 ] CVE-2009-5022
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-5022
[ 3 ] CVE-2010-1411
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-1411
[ 4 ] CVE-2010-2065
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2065
[ 5 ] CVE-2010-2067
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2067
[ 6 ] CVE-2010-2233
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2233
[ 7 ] CVE-2010-2443
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2443
[ 8 ] CVE-2010-2481
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2481
[ 9 ] CVE-2010-2482
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2482
[ 10 ] CVE-2010-2483
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2483
[ 11 ] CVE-2010-2595
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2595
[ 12 ] CVE-2010-2596
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2596
[ 13 ] CVE-2010-2597
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2597
[ 14 ] CVE-2010-2630
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2630
[ 15 ] CVE-2010-2631
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-2631
[ 16 ] CVE-2010-3087
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3087
[ 17 ] CVE-2010-4665
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4665
[ 18 ] CVE-2011-0192
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0192
[ 19 ] CVE-2011-0192
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0192
[ 20 ] CVE-2011-1167
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1167
[ 21 ] CVE-2011-1167
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1167
[ 22 ] CVE-2012-1173
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1173
[ 23 ] CVE-2012-2088
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2088
[ 24 ] CVE-2012-2113
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2113
[ 25 ] CVE-2012-3401
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3401
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201209-02.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite. or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2012 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Posljednje sigurnosne preporuke