Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | libtiff security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2012:0468 | First vendor Publication | 2012-04-10 |
| Vendor | RedHat | Last vendor Modification | 2012-04-10 |
| Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated libtiff packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files. Two integer overflow flaws, leading to heap-based buffer overflows, were found in the way libtiff attempted to allocate space for a tile in a TIFF image file. An attacker could use these flaws to create a specially-crafted TIFF file that, when opened, would cause an application linked against libtiff to crash or, possibly, execute arbitrary code. (CVE-2012-1173) All libtiff users should upgrade to these updated packages, which contain a backported patch to resolve these issues. All running applications linked against libtiff must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 5. Bugs fixed (http://bugzilla.redhat.com/): 803078 - CVE-2012-1173 libtiff: Heap-buffer overflow due to TileSize calculation when parsing tiff files |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2012-0468.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:18472 | |||
| Oval ID: | oval:org.mitre.oval:def:18472 | ||
| Title: | DSA-2447-1 tiff - integer overflow | ||
| Description: | Alexander Gavrun discovered an integer overflow in the TIFF library in the parsing of the TileSize entry, which could result in the execution of arbitrary code if a malformed image is opened. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2447-1 CVE-2012-1173 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | tiff |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:21264 | |||
| Oval ID: | oval:org.mitre.oval:def:21264 | ||
| Title: | RHSA-2012:0468: libtiff security update (Important) | ||
| Description: | Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a TIFF file, which is not properly handled by the (1) gtTileSeparate or (2) gtStripSeparate function, leading to a heap-based buffer overflow. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2012:0468-02 CESA-2012:0468 CVE-2012-1173 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 6 CentOS Linux 5 CentOS Linux 6 | Product(s): | libtiff |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22893 | |||
| Oval ID: | oval:org.mitre.oval:def:22893 | ||
| Title: | DEPRECATED: ELSA-2012:0468: libtiff security update (Important) | ||
| Description: | Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a TIFF file, which is not properly handled by the (1) gtTileSeparate or (2) gtStripSeparate function, leading to a heap-based buffer overflow. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012:0468-02 CVE-2012-1173 | Version: | 7 |
| Platform(s): | Oracle Linux 5 Oracle Linux 6 | Product(s): | libtiff |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:23728 | |||
| Oval ID: | oval:org.mitre.oval:def:23728 | ||
| Title: | ELSA-2012:0468: libtiff security update (Important) | ||
| Description: | Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a TIFF file, which is not properly handled by the (1) gtTileSeparate or (2) gtStripSeparate function, leading to a heap-based buffer overflow. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012:0468-02 CVE-2012-1173 | Version: | 6 |
| Platform(s): | Oracle Linux 5 Oracle Linux 6 | Product(s): | libtiff |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:25737 | |||
| Oval ID: | oval:org.mitre.oval:def:25737 | ||
| Title: | SUSE-SU-2013:1639-1 -- Security update for libtiff | ||
| Description: | This tiff LTSS roll up update fixes several security issues. | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2013:1639-1 CVE-2013-4232 CVE-2013-4231 CVE-2013-4243 CVE-2013-4244 CVE-2013-1961 CVE-2013-1960 CVE-2012-4447 CVE-2012-4564 CVE-2012-5581 CVE-2012-3401 CVE-2012-2113 CVE-2012-2088 CVE-2012-1173 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 10 | Product(s): | libtiff |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:27419 | |||
| Oval ID: | oval:org.mitre.oval:def:27419 | ||
| Title: | DEPRECATED: ELSA-2012-0468 -- libtiff security update (important) | ||
| Description: | [3.9.4-5] - Add fix for CVE-2012-1173 Resolves: #CVE-2012-1173 | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2012-0468 CVE-2012-1173 | Version: | 4 |
| Platform(s): | Oracle Linux 5 Oracle Linux 6 | Product(s): | libtiff |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 1 |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-12-31 | Name : Fedora Update for libtiff FEDORA-2012-20404 File : nvt/gb_fedora_2012_20404_libtiff_fc16.nasl |
| 2012-09-26 | Name : Gentoo Security Advisory GLSA 201209-02 (tiff) File : nvt/glsa_201209_02.nasl |
| 2012-09-25 | Name : Mac OS X v10.6.8 Multiple Vulnerabilities (2012-004) File : nvt/gb_macosx_su12-004.nasl |
| 2012-09-10 | Name : Slackware Advisory SSA:2012-098-01 libtiff File : nvt/esoft_slk_ssa_2012_098_01.nasl |
| 2012-08-30 | Name : Fedora Update for libtiff FEDORA-2012-5463 File : nvt/gb_fedora_2012_5463_libtiff_fc17.nasl |
| 2012-08-14 | Name : Fedora Update for libtiff FEDORA-2012-10978 File : nvt/gb_fedora_2012_10978_libtiff_fc16.nasl |
| 2012-08-03 | Name : Mandriva Update for libtiff MDVSA-2012:054 (libtiff) File : nvt/gb_mandriva_MDVSA_2012_054.nasl |
| 2012-07-30 | Name : CentOS Update for libtiff CESA-2012:0468 centos5 File : nvt/gb_CESA-2012_0468_libtiff_centos5.nasl |
| 2012-07-30 | Name : CentOS Update for libtiff CESA-2012:0468 centos6 File : nvt/gb_CESA-2012_0468_libtiff_centos6.nasl |
| 2012-07-16 | Name : Fedora Update for libtiff FEDORA-2012-10089 File : nvt/gb_fedora_2012_10089_libtiff_fc16.nasl |
| 2012-04-30 | Name : Debian Security Advisory DSA 2447-1 (tiff) File : nvt/deb_2447_1.nasl |
| 2012-04-23 | Name : Fedora Update for libtiff FEDORA-2012-5410 File : nvt/gb_fedora_2012_5410_libtiff_fc16.nasl |
| 2012-04-20 | Name : Fedora Update for libtiff FEDORA-2012-5406 File : nvt/gb_fedora_2012_5406_libtiff_fc15.nasl |
| 2012-04-11 | Name : RedHat Update for libtiff RHSA-2012:0468-01 File : nvt/gb_RHSA-2012_0468-01_libtiff.nasl |
| 2012-04-05 | Name : Ubuntu Update for tiff USN-1416-1 File : nvt/gb_ubuntu_USN_1416_1.nasl |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_libtiff_20120710.nasl - Type : ACT_GATHER_INFO |
| 2015-01-12 | Name : The remote device is missing a vendor-supplied security patch. File : f5_bigip_SOL15863.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2012-234.nasl - Type : ACT_GATHER_INFO |
| 2013-09-04 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2012-65.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2012-0468.nasl - Type : ACT_GATHER_INFO |
| 2012-09-27 | Name : The remote device is affected by multiple vulnerabilities. File : appletv_5_1.nasl - Type : ACT_GATHER_INFO |
| 2012-09-24 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201209-02.nasl - Type : ACT_GATHER_INFO |
| 2012-09-20 | Name : The remote host is missing a Mac OS X update that fixes multiple security vul... File : macosx_10_7_5.nasl - Type : ACT_GATHER_INFO |
| 2012-09-20 | Name : The remote host is missing a Mac OS X update that fixes multiple security vul... File : macosx_SecUpd2012-004.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20120410_libtiff_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2012-06-14 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2012-098-01.nasl - Type : ACT_GATHER_INFO |
| 2012-04-23 | Name : The remote Fedora host is missing a security update. File : fedora_2012-5410.nasl - Type : ACT_GATHER_INFO |
| 2012-04-19 | Name : The remote Fedora host is missing a security update. File : fedora_2012-5406.nasl - Type : ACT_GATHER_INFO |
| 2012-04-18 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_libtiff-devel-120405.nasl - Type : ACT_GATHER_INFO |
| 2012-04-18 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_libtiff-8055.nasl - Type : ACT_GATHER_INFO |
| 2012-04-12 | Name : The remote Fedora host is missing a security update. File : fedora_2012-5463.nasl - Type : ACT_GATHER_INFO |
| 2012-04-11 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2012-0468.nasl - Type : ACT_GATHER_INFO |
| 2012-04-11 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2012-0468.nasl - Type : ACT_GATHER_INFO |
| 2012-04-06 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2447.nasl - Type : ACT_GATHER_INFO |
| 2012-04-05 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2012-054.nasl - Type : ACT_GATHER_INFO |
| 2012-04-05 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1416-1.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:55:50 |
|
