6.8 - MDVSA-2012:054

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	MDVSA-2012:054	First vendor Publication	2012-04-05
Vendor	Mandriva	Last vendor Modification	2012-04-05
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score	6.8	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A vulnerability has been found and corrected in libtiff:

An integer overflow was discovered in the libtiff/tiff_getimage.c file in the tiff library which could cause execution of arbitrary code using a specially crafted TIFF image file (CVE-2012-1173).

The updated packages have been patched to correct this issue.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2012:054

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-189	Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:18472

Oval ID:	oval:org.mitre.oval:def:18472
Title:	DSA-2447-1 tiff - integer overflow
Description:	Alexander Gavrun discovered an integer overflow in the TIFF library in the parsing of the TileSize entry, which could result in the execution of arbitrary code if a malformed image is opened.
Family:	unix	Class:	patch
Reference(s):	DSA-2447-1 CVE-2012-1173	Version:	7
Platform(s):	Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0	Product(s):	tiff
Definition Synopsis:
Debian 6.0 is installed GNU/Linux or GNU/kFreeBSD kernel Debian GNU/Linux is installed AND Debian GNU/kFreeBSD is installed AND tiff DPKG is earlier than 3.9.4-5+squeeze4

Definition Id: oval:org.mitre.oval:def:21264

Oval ID:	oval:org.mitre.oval:def:21264
Title:	RHSA-2012:0468: libtiff security update (Important)
Description:	Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a TIFF file, which is not properly handled by the (1) gtTileSeparate or (2) gtStripSeparate function, leading to a heap-based buffer overflow.
Family:	unix	Class:	patch
Reference(s):	RHSA-2012:0468-02 CESA-2012:0468 CVE-2012-1173	Version:	4
Platform(s):	Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 CentOS Linux 5 CentOS Linux 6	Product(s):	libtiff
Definition Synopsis:
Operation system section Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages section libtiff is earlier than 0:3.8.2-14.el5_8 AND libtiff-devel is earlier than 0:3.8.2-14.el5_8 AND Operation system section Redhat 6 or Centos 6 release The operating system installed on the system is Red Hat Enterprise Linux 6 AND The operating system installed on the system is CentOS Linux 6.x Packages section libtiff is earlier than 0:3.9.4-5.el6_2 AND libtiff-static is earlier than 0:3.9.4-5.el6_2 AND libtiff-devel is earlier than 0:3.9.4-5.el6_2

Definition Id: oval:org.mitre.oval:def:22893

Oval ID:	oval:org.mitre.oval:def:22893
Title:	DEPRECATED: ELSA-2012:0468: libtiff security update (Important)
Description:	Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a TIFF file, which is not properly handled by the (1) gtTileSeparate or (2) gtStripSeparate function, leading to a heap-based buffer overflow.
Family:	unix	Class:	patch
Reference(s):	ELSA-2012:0468-02 CVE-2012-1173	Version:	7
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	libtiff
Definition Synopsis:
rpm test Oracle Linux 5.x AND rpm test libtiff is earlier than 0:3.8.2-14.el5_8 AND libtiff-devel is earlier than 0:3.8.2-14.el5_8 OR rpm test Oracle Linux 6.x AND rpm test libtiff is earlier than 0:3.9.4-5.el6_2 AND libtiff-static is earlier than 0:3.9.4-5.el6_2 AND libtiff-devel is earlier than 0:3.9.4-5.el6_2

Definition Id: oval:org.mitre.oval:def:23728

Oval ID:	oval:org.mitre.oval:def:23728
Title:	ELSA-2012:0468: libtiff security update (Important)
Description:	Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a TIFF file, which is not properly handled by the (1) gtTileSeparate or (2) gtStripSeparate function, leading to a heap-based buffer overflow.
Family:	unix	Class:	patch
Reference(s):	ELSA-2012:0468-02 CVE-2012-1173	Version:	6
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	libtiff
Definition Synopsis:
rpm test Oracle Linux 5.x AND rpm test libtiff is earlier than 0:3.8.2-14.el5_8 AND libtiff-devel is earlier than 0:3.8.2-14.el5_8 OR rpm test Oracle Linux 6.x AND rpm test libtiff is earlier than 0:3.9.4-5.el6_2 AND libtiff-static is earlier than 0:3.9.4-5.el6_2 AND libtiff-devel is earlier than 0:3.9.4-5.el6_2

Definition Id: oval:org.mitre.oval:def:25737

Oval ID:	oval:org.mitre.oval:def:25737
Title:	SUSE-SU-2013:1639-1 -- Security update for libtiff
Description:	This tiff LTSS roll up update fixes several security issues.
Family:	unix	Class:	patch
Reference(s):	SUSE-SU-2013:1639-1 CVE-2013-4232 CVE-2013-4231 CVE-2013-4243 CVE-2013-4244 CVE-2013-1961 CVE-2013-1960 CVE-2012-4447 CVE-2012-4564 CVE-2012-5581 CVE-2012-3401 CVE-2012-2113 CVE-2012-2088 CVE-2012-1173	Version:	3
Platform(s):	SUSE Linux Enterprise Server 10	Product(s):	libtiff
Definition Synopsis:
SUSE Linux Enterprise Server 10 is installed Packages match section libtiff RPM is earlier than 0:3.8.2-5.36.1 AND libtiff-devel RPM is earlier than 0:3.8.2-5.36.1 AND tiff RPM is earlier than 0:3.8.2-5.36.1 AND libtiff-32bit RPM is earlier than 0:3.8.2-5.36.1 AND libtiff-devel-32bit RPM is earlier than 0:3.8.2-5.36.1

Definition Id: oval:org.mitre.oval:def:27419

Oval ID:	oval:org.mitre.oval:def:27419
Title:	DEPRECATED: ELSA-2012-0468 -- libtiff security update (important)
Description:	[3.9.4-5] - Add fix for CVE-2012-1173 Resolves: #CVE-2012-1173
Family:	unix	Class:	patch
Reference(s):	ELSA-2012-0468 CVE-2012-1173	Version:	4
Platform(s):	Oracle Linux 5 Oracle Linux 6	Product(s):	libtiff
Definition Synopsis:
Oracle Linux 5 release section Oracle Linux 5.x Packages match section libtiff is earlier than 0:3.8.2-14.el5_8 AND libtiff-devel is earlier than 0:3.8.2-14.el5_8 AND Oracle Linux 6 release section Oracle Linux 6.x Packages match section libtiff is earlier than 0:3.9.4-5.el6_2 AND libtiff-devel is earlier than 0:3.9.4-5.el6_2 AND libtiff-static is earlier than 0:3.9.4-5.el6_2

CPE : Common Platform Enumeration

Type	Description	Count
Application	Libtiff cpe:2.3:a:libtiff:libtiff:3.9.4:::::::*	1

OpenVAS Exploits

Date	Description
2012-12-31	Name : Fedora Update for libtiff FEDORA-2012-20404 File : nvt/gb_fedora_2012_20404_libtiff_fc16.nasl
2012-09-26	Name : Gentoo Security Advisory GLSA 201209-02 (tiff) File : nvt/glsa_201209_02.nasl
2012-09-25	Name : Mac OS X v10.6.8 Multiple Vulnerabilities (2012-004) File : nvt/gb_macosx_su12-004.nasl
2012-09-10	Name : Slackware Advisory SSA:2012-098-01 libtiff File : nvt/esoft_slk_ssa_2012_098_01.nasl
2012-08-30	Name : Fedora Update for libtiff FEDORA-2012-5463 File : nvt/gb_fedora_2012_5463_libtiff_fc17.nasl
2012-08-14	Name : Fedora Update for libtiff FEDORA-2012-10978 File : nvt/gb_fedora_2012_10978_libtiff_fc16.nasl
2012-08-03	Name : Mandriva Update for libtiff MDVSA-2012:054 (libtiff) File : nvt/gb_mandriva_MDVSA_2012_054.nasl
2012-07-30	Name : CentOS Update for libtiff CESA-2012:0468 centos5 File : nvt/gb_CESA-2012_0468_libtiff_centos5.nasl
2012-07-30	Name : CentOS Update for libtiff CESA-2012:0468 centos6 File : nvt/gb_CESA-2012_0468_libtiff_centos6.nasl
2012-07-16	Name : Fedora Update for libtiff FEDORA-2012-10089 File : nvt/gb_fedora_2012_10089_libtiff_fc16.nasl
2012-04-30	Name : Debian Security Advisory DSA 2447-1 (tiff) File : nvt/deb_2447_1.nasl
2012-04-23	Name : Fedora Update for libtiff FEDORA-2012-5410 File : nvt/gb_fedora_2012_5410_libtiff_fc16.nasl
2012-04-20	Name : Fedora Update for libtiff FEDORA-2012-5406 File : nvt/gb_fedora_2012_5406_libtiff_fc15.nasl
2012-04-11	Name : RedHat Update for libtiff RHSA-2012:0468-01 File : nvt/gb_RHSA-2012_0468-01_libtiff.nasl
2012-04-05	Name : Ubuntu Update for tiff USN-1416-1 File : nvt/gb_ubuntu_USN_1416_1.nasl

Nessus® Vulnerability Scanner

Date	Description
2015-01-19	Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_libtiff_20120710.nasl - Type : ACT_GATHER_INFO
2015-01-12	Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL15863.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-234.nasl - Type : ACT_GATHER_INFO
2013-09-04	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2012-65.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-0468.nasl - Type : ACT_GATHER_INFO
2012-09-27	Name : The remote device is affected by multiple vulnerabilities. File : appletv_5_1.nasl - Type : ACT_GATHER_INFO
2012-09-24	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201209-02.nasl - Type : ACT_GATHER_INFO
2012-09-20	Name : The remote host is missing a Mac OS X update that fixes multiple security vul... File : macosx_10_7_5.nasl - Type : ACT_GATHER_INFO
2012-09-20	Name : The remote host is missing a Mac OS X update that fixes multiple security vul... File : macosx_SecUpd2012-004.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120410_libtiff_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-06-14	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2012-098-01.nasl - Type : ACT_GATHER_INFO
2012-04-23	Name : The remote Fedora host is missing a security update. File : fedora_2012-5410.nasl - Type : ACT_GATHER_INFO
2012-04-19	Name : The remote Fedora host is missing a security update. File : fedora_2012-5406.nasl - Type : ACT_GATHER_INFO
2012-04-18	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libtiff-devel-120405.nasl - Type : ACT_GATHER_INFO
2012-04-18	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_libtiff-8055.nasl - Type : ACT_GATHER_INFO
2012-04-12	Name : The remote Fedora host is missing a security update. File : fedora_2012-5463.nasl - Type : ACT_GATHER_INFO
2012-04-11	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-0468.nasl - Type : ACT_GATHER_INFO
2012-04-11	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-0468.nasl - Type : ACT_GATHER_INFO
2012-04-06	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2447.nasl - Type : ACT_GATHER_INFO
2012-04-05	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2012-054.nasl - Type : ACT_GATHER_INFO
2012-04-05	Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1416-1.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:42:49	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	6
CPE ID(s)	1
Openvas Exploit(s)	15
Nessus® Exploit(s)	21

	Related
6.8	CVE-2012-1173
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)