Executive Summary

Summary
Title tiff regression
Informations
Name USN-1085-2 First vendor Publication 2011-03-15
Vendor Ubuntu Last vendor Modification 2011-03-15
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS Ubuntu 8.04 LTS Ubuntu 9.10 Ubuntu 10.04 LTS Ubuntu 10.10

This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the following package versions:

Ubuntu 6.06 LTS:
libtiff4 3.7.4-1ubuntu3.10

Ubuntu 8.04 LTS:
libtiff4 3.8.2-7ubuntu3.8

Ubuntu 9.10:
libtiff4 3.8.2-13ubuntu0.5

Ubuntu 10.04 LTS:
libtiff4 3.9.2-2ubuntu0.5

Ubuntu 10.10:
libtiff4 3.9.4-2ubuntu0.2

After a standard system update you need to restart your session to make all the necessary changes.

Details follow:

USN-1085-1 fixed vulnerabilities in the system TIFF library. The upstream fixes were incomplete and created problems for certain CCITTFAX4 files. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Sauli Pahlman discovered that the TIFF library incorrectly handled invalid
td_stripbytecount fields. If a user or automated system were tricked into
opening a specially crafted TIFF image, a remote attacker could crash the
application, leading to a denial of service. This issue only affected
Ubuntu 10.04 LTS and 10.10. (CVE-2010-2482)

Sauli Pahlman discovered that the TIFF library incorrectly handled TIFF
files with an invalid combination of SamplesPerPixel and Photometric
values. If a user or automated system were tricked into opening a specially
crafted TIFF image, a remote attacker could crash the application, leading
to a denial of service. This issue only affected Ubuntu 10.10.
(CVE-2010-2482)

Nicolae Ghimbovschi discovered that the TIFF library incorrectly handled
invalid ReferenceBlackWhite values. If a user or automated system were
tricked into opening a specially crafted TIFF image, a remote attacker
could crash the application, leading to a denial of service.
(CVE-2010-2595)

Sauli Pahlman discovered that the TIFF library incorrectly handled certain
default fields. If a user or automated system were tricked into opening a
specially crafted TIFF image, a remote attacker could crash the
application, leading to a denial of service. (CVE-2010-2597, CVE-2010-2598)

It was discovered that the TIFF library incorrectly validated certain
data types. If a user or automated system were tricked into opening a
specially crafted TIFF image, a remote attacker could crash the
application, leading to a denial of service. (CVE-2010-2630)

It was discovered that the TIFF library incorrectly handled downsampled
JPEG data. If a user or automated system were tricked into opening a
specially crafted TIFF image, a remote attacker could execute arbitrary
code with user privileges, or crash the application, leading to a denial of
service. This issue only affected Ubuntu 10.04 LTS and 10.10.
(CVE-2010-3087)

It was discovered that the TIFF library incorrectly handled certain JPEG
data. If a user or automated system were tricked into opening a specially
crafted TIFF image, a remote attacker could execute arbitrary code with
user privileges, or crash the application, leading to a denial of service.
This issue only affected Ubuntu 6.06 LTS, 8.04 LTS and 9.10.
(CVE-2011-0191)

It was discovered that the TIFF library incorrectly handled certain TIFF
FAX images. If a user or automated system were tricked into opening a
specially crafted TIFF FAX image, a remote attacker could execute arbitrary
code with user privileges, or crash the application, leading to a denial of
service. (CVE-2011-0191)

Original Source

Url : http://www.ubuntu.com/usn/USN-1085-2

CWE : Common Weakness Enumeration

% Id Name
67 % CWE-20 Improper Input Validation
33 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13452
 
Oval ID: oval:org.mitre.oval:def:13452
Title: USN-1085-2 -- tiff regression
Description: USN-1085-1 fixed vulnerabilities in the system TIFF library. The upstream fixes were incomplete and created problems for certain CCITTFAX4 files. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Sauli Pahlman discovered that the TIFF library incorrectly handled invalid td_stripbytecount fields. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. This issue only affected Ubuntu 10.04 LTS and 10.10. Sauli Pahlman discovered that the TIFF library incorrectly handled TIFF files with an invalid combination of SamplesPerPixel and Photometric values. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. This issue only affected Ubuntu 10.10. Nicolae Ghimbovschi discovered that the TIFF library incorrectly handled invalid ReferenceBlackWhite values. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. Sauli Pahlman discovered that the TIFF library incorrectly handled certain default fields. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. It was discovered that the TIFF library incorrectly validated certain data types. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could crash the application, leading to a denial of service. It was discovered that the TIFF library incorrectly handled downsampled JPEG data. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could execute arbitrary code with user privileges, or crash the application, leading to a denial of service. This issue only affected Ubuntu 10.04 LTS and 10.10. It was discovered that the TIFF library incorrectly handled certain JPEG data. If a user or automated system were tricked into opening a specially crafted TIFF image, a remote attacker could execute arbitrary code with user privileges, or crash the application, leading to a denial of service. This issue only affected Ubuntu 6.06 LTS, 8.04 LTS and 9.10. It was discovered that the TIFF library incorrectly handled certain TIFF FAX images. If a user or automated system were tricked into opening a specially crafted TIFF FAX image, a remote attacker could execute arbitrary code with user privileges, or crash the application, leading to a denial of service
Family: unix Class: patch
Reference(s): USN-1085-2
CVE-2010-2482
CVE-2010-2595
CVE-2010-2597
CVE-2010-2598
CVE-2010-2630
CVE-2010-3087
CVE-2011-0191
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 10.10
Ubuntu 10.04
Ubuntu 9.10
Ubuntu 6.06
Product(s): tiff
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 263
Application 49
Os 1
Os 7

OpenVAS Exploits

Date Description
2012-10-03 Name : Debian Security Advisory DSA 2552-1 (tiff)
File : nvt/deb_2552_1.nasl
2012-09-26 Name : Gentoo Security Advisory GLSA 201209-02 (tiff)
File : nvt/glsa_201209_02.nasl
2011-08-26 Name : Mac OS X v10.6.6 Multiple Vulnerabilities (2011-001)
File : nvt/secpod_macosx_su11-001.nasl
2011-08-09 Name : CentOS Update for libtiff CESA-2010:0519 centos5 i386
File : nvt/gb_CESA-2010_0519_libtiff_centos5_i386.nasl
2011-05-12 Name : Debian Security Advisory DSA 2210-1 (tiff)
File : nvt/deb_2210_1.nasl
2011-05-06 Name : SuSE Update for kernel SUSE-SA:2011:020
File : nvt/gb_suse_2011_020.nasl
2011-04-06 Name : Mandriva Update for libtiff MDVSA-2011:064 (libtiff)
File : nvt/gb_mandriva_MDVSA_2011_064.nasl
2011-03-24 Name : Ubuntu Update for tiff regression USN-1085-2
File : nvt/gb_ubuntu_USN_1085_2.nasl
2011-03-15 Name : Ubuntu Update for tiff vulnerabilities USN-1085-1
File : nvt/gb_ubuntu_USN_1085_1.nasl
2011-03-10 Name : Apple iTunes Multiple Vulnerabilities - Mar11
File : nvt/gb_apple_itunes_mult_vuln_mar11.nasl
2010-10-01 Name : Mandriva Update for libtiff MDVSA-2010:190 (libtiff)
File : nvt/gb_mandriva_MDVSA_2010_190.nasl
2010-08-20 Name : CentOS Update for libtiff CESA-2010:0520 centos3 i386
File : nvt/gb_CESA-2010_0520_libtiff_centos3_i386.nasl
2010-08-09 Name : Mandriva Update for libtiff MDVSA-2010:145 (libtiff)
File : nvt/gb_mandriva_MDVSA_2010_145.nasl
2010-08-09 Name : Mandriva Update for libtiff MDVSA-2010:146 (libtiff)
File : nvt/gb_mandriva_MDVSA_2010_146.nasl
2010-07-12 Name : RedHat Update for libtiff RHSA-2010:0519-01
File : nvt/gb_RHSA-2010_0519-01_libtiff.nasl
2010-07-12 Name : RedHat Update for libtiff RHSA-2010:0520-01
File : nvt/gb_RHSA-2010_0520-01_libtiff.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
71519 Apple ImageIO / Apple TV Library JPEG-Encoded TIFF Image Handling Overflow

Apple ImageIO and Apple TV are prone to an overflow condition. The LibTIFF library fails to properly sanitize user-supplied input resulting in a buffer overflow. With a specially crafted TIFF image with JPEG encoding, a context-dependent attacker can potentially execute arbitrary code.
68274 LibTIFF on openSUSE Crafted TIFF Image Handling DoS

66089 LibTIFF TIFFReadDirectory Function TIFF File Codec-specific Tag Out-of-order ...

66083 LibTIFF td_stripbytecount Field Handling Weakness Crafted TIFF File DoS

65972 LibTIFF on RHEL Unconfigured Compression Functionality Downsampled OJPEG Inpu...

65971 LibTIFF tif_strip.c TIFFVStripSize Function Downsampled OJPEG Input DoS

65969 LibTIFF TIFFYCbCrtoRGB Function Downsampled OJPEG Input ReferenceBlackWhite V...

Nessus® Vulnerability Scanner

Date Description
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_4_libtiff-devel-110314.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_4_kernel-110426.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_3_libtiff-devel-110314.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_3_libtiff-devel-100915.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_3_kernel-110414.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0520.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0519.nasl - Type : ACT_GATHER_INFO
2012-09-27 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2552.nasl - Type : ACT_GATHER_INFO
2012-09-24 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201209-02.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100708_libtiff_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-05-17 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_kernel-7515.nasl - Type : ACT_GATHER_INFO
2011-12-13 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_kernel-7516.nasl - Type : ACT_GATHER_INFO
2011-12-13 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_libtiff-7474.nasl - Type : ACT_GATHER_INFO
2011-08-11 Name : The remote Windows host has an application that is affected by multiple vulne...
File : blackberry_es_png_kb27244.nasl - Type : ACT_GATHER_INFO
2011-06-30 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_kernel-7568.nasl - Type : ACT_GATHER_INFO
2011-05-05 Name : The remote openSUSE host is missing a security update.
File : suse_11_2_libtiff-devel-110314.nasl - Type : ACT_GATHER_INFO
2011-04-28 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_kernel-110414.nasl - Type : ACT_GATHER_INFO
2011-04-28 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_kernel-110415.nasl - Type : ACT_GATHER_INFO
2011-04-05 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2011-064.nasl - Type : ACT_GATHER_INFO
2011-04-04 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2210.nasl - Type : ACT_GATHER_INFO
2011-03-27 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_libtiff-7376.nasl - Type : ACT_GATHER_INFO
2011-03-22 Name : The remote host is missing a Mac OS X update that fixes several security issues.
File : macosx_SecUpd2011-001.nasl - Type : ACT_GATHER_INFO
2011-03-22 Name : The remote host is missing a Mac OS X update that fixes several security issues.
File : macosx_10_6_7.nasl - Type : ACT_GATHER_INFO
2011-03-18 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12686.nasl - Type : ACT_GATHER_INFO
2011-03-18 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_libtiff-devel-110314.nasl - Type : ACT_GATHER_INFO
2011-03-15 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1085-2.nasl - Type : ACT_GATHER_INFO
2011-03-10 Name : The remote host contains a web browser that is affected by several vulnerabil...
File : safari_5_0_4.nasl - Type : ACT_GATHER_INFO
2011-03-08 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1085-1.nasl - Type : ACT_GATHER_INFO
2011-03-03 Name : The remote host contains a multimedia application that has multiple vulnerabi...
File : itunes_10_2_banner.nasl - Type : ACT_GATHER_INFO
2011-03-03 Name : The remote host contains an application that has multiple vulnerabilities.
File : itunes_10_2.nasl - Type : ACT_GATHER_INFO
2010-10-06 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-190.nasl - Type : ACT_GATHER_INFO
2010-08-17 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0520.nasl - Type : ACT_GATHER_INFO
2010-08-09 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-146.nasl - Type : ACT_GATHER_INFO
2010-08-09 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2010-145.nasl - Type : ACT_GATHER_INFO
2010-07-28 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0520.nasl - Type : ACT_GATHER_INFO
2010-07-28 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0519.nasl - Type : ACT_GATHER_INFO
2010-07-16 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0519.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:58:23
  • Multiple Updates