ZeroBox Vulnerability Database

漏洞起因
边界条件错误
危险等级
低

影响系统
LibTIFF LibTIFF 3.9.4
LibTIFF LibTIFF 3.9.3
LibTIFF LibTIFF 3.9.2
LibTIFF LibTIFF 3.9.2
LibTIFF LibTIFF 3.9
LibTIFF LibTIFF 3.8.2
+ Debian Linux 3.1 sparc
+ Debian Linux 3.1 s/390
+ Debian Linux 3.1 ppc
+ Debian Linux 3.1 mipsel
+ Debian Linux 3.1 mips
+ Debian Linux 3.1 m68k
+ Debian Linux 3.1 ia-64
+ Debian Linux 3.1 ia-32
+ Debian Linux 3.1 hppa
+ Debian Linux 3.1 arm
+ Debian Linux 3.1 alpha
+ Debian Linux 3.1
LibTIFF LibTIFF 3.8.1
+ Debian Linux 3.1 sparc
+ Debian Linux 3.1 s/390
+ Debian Linux 3.1 ppc
+ Debian Linux 3.1 mipsel
+ Debian Linux 3.1 mips
+ Debian Linux 3.1 m68k
+ Debian Linux 3.1 ia-64
+ Debian Linux 3.1 ia-32
+ Debian Linux 3.1 hppa
+ Debian Linux 3.1 arm
+ Debian Linux 3.1 alpha
+ Debian Linux 3.1
LibTIFF LibTIFF 3.8.1
LibTIFF LibTIFF 3.8
LibTIFF LibTIFF 3.8
+ Debian Linux 3.1 sparc
+ Debian Linux 3.1 s/390
+ Debian Linux 3.1 ppc
+ Debian Linux 3.1 mipsel
+ Debian Linux 3.1 mips
+ Debian Linux 3.1 m68k
+ Debian Linux 3.1 ia-64
+ Debian Linux 3.1 ia-32
+ Debian Linux 3.1 hppa
+ Debian Linux 3.1 arm
+ Debian Linux 3.1 alpha
+ Debian Linux 3.1
LibTIFF LibTIFF 3.7.4
+ Debian Linux 3.1 sparc
+ Debian Linux 3.1 s/390
+ Debian Linux 3.1 ppc
+ Debian Linux 3.1 mipsel
+ Debian Linux 3.1 mips
+ Debian Linux 3.1 m68k
+ Debian Linux 3.1 ia-64
+ Debian Linux 3.1 ia-32
+ Debian Linux 3.1 hppa
+ Debian Linux 3.1 arm
+ Debian Linux 3.1 alpha
+ Debian Linux 3.1
LibTIFF LibTIFF 3.7.3
+ Debian Linux 3.1 sparc
+ Debian Linux 3.1 s/390
+ Debian Linux 3.1 ppc
+ Debian Linux 3.1 mipsel
+ Debian Linux 3.1 mips
+ Debian Linux 3.1 m68k
+ Debian Linux 3.1 ia-64
+ Debian Linux 3.1 ia-32
+ Debian Linux 3.1 hppa
+ Debian Linux 3.1 arm
+ Debian Linux 3.1 alpha
+ Debian Linux 3.1
LibTIFF LibTIFF 3.7.2
+ Debian Linux 3.1 sparc
+ Debian Linux 3.1 s/390
+ Debian Linux 3.1 ppc
+ Debian Linux 3.1 mipsel
+ Debian Linux 3.1 mips
+ Debian Linux 3.1 m68k
+ Debian Linux 3.1 ia-64
+ Debian Linux 3.1 ia-32
+ Debian Linux 3.1 hppa
+ Debian Linux 3.1 arm
+ Debian Linux 3.1 alpha
+ Debian Linux 3.1
LibTIFF LibTIFF 3.7.1
LibTIFF LibTIFF 3.7.1
LibTIFF LibTIFF 3.7
LibTIFF LibTIFF 3.7
+ Slackware Linux 10.0
+ Slackware Linux -current
LibTIFF LibTIFF 3.6.1
LibTIFF LibTIFF 3.6.1
+ Gentoo Linux 1.4
+ Gentoo Linux
+ OpenPKG OpenPKG Current
+ Turbolinux Turbolinux Server 10.0
+ Ubuntu Ubuntu Linux 5.0 4 powerpc
+ Ubuntu Ubuntu Linux 5.0 4 i386
+ Ubuntu Ubuntu Linux 5.0 4 amd64
+ Ubuntu Ubuntu Linux 4.1 ppc
+ Ubuntu Ubuntu Linux 4.1 ia64
+ Ubuntu Ubuntu Linux 4.1 ia32
LibTIFF LibTIFF 3.6 .0
LibTIFF LibTIFF 3.6
LibTIFF LibTIFF 3.5.7
LibTIFF LibTIFF 3.5.7
+ Red Hat Fedora Core2
+ Slackware Linux 9.1
+ Slackware Linux 9.0
+ Slackware Linux 8.1
+ Turbolinux Appliance Server Hosting Edition 1.0
+ Turbolinux Appliance Server Workgroup Edition 1.0
+ Turbolinux Turbolinux Desktop 10.0
+ Turbolinux Turbolinux Server 8.0
LibTIFF LibTIFF 3.5.6
LibTIFF LibTIFF 3.5.5
+ Debian Linux 3.0 sparc
+ Debian Linux 3.0 s/390
+ Debian Linux 3.0 ppc
+ Debian Linux 3.0 mipsel
+ Debian Linux 3.0 mips
+ Debian Linux 3.0 m68k
+ Debian Linux 3.0 ia-64
+ Debian Linux 3.0 ia-32
+ Debian Linux 3.0 hppa
+ Debian Linux 3.0 arm
+ Debian Linux 3.0 alpha
+ Debian Linux 3.0
+ Turbolinux Turbolinux Server 7.0
+ Turbolinux Turbolinux Workstation 8.0
+ Turbolinux Turbolinux Workstation 7.0
LibTIFF LibTIFF 3.5.4
LibTIFF LibTIFF 3.5.3
LibTIFF LibTIFF 3.5.2
LibTIFF LibTIFF 3.5.2
LibTIFF LibTIFF 3.5.1
LibTIFF LibTIFF 3.4
LibTIFF LibTIFF 4.0 Beta6
LibTIFF LibTIFF 4.0 Beta5
LibTIFF LibTIFF 4.0 Beta4
LibTIFF LibTIFF 4.0 Beta3
LibTIFF LibTIFF 4.0 Beta2
LibTIFF LibTIFF 4.0 Beta1
LibTIFF LibTIFF 4.0 Alpha
LibTIFF LibTIFF 4.0
LibTIFF LibTIFF 3.9.4
LibTIFF LibTIFF 3.9.2-5.2.1
LibTIFF LibTIFF 3.9.1
LibTIFF LibTIFF 3.9.0 Beta
LibTIFF LibTIFF 3.9
LibTIFF LibTIFF 3.7.3
LibTIFF LibTIFF 3.7.2-7
+ Debian Linux 3.1 sparc
+ Debian Linux 3.1 s/390
+ Debian Linux 3.1 ppc
+ Debian Linux 3.1 mipsel
+ Debian Linux 3.1 mips
+ Debian Linux 3.1 m68k
+ Debian Linux 3.1 ia-64
+ Debian Linux 3.1 ia-32
+ Debian Linux 3.1 hppa
+ Debian Linux 3.1 arm
+ Debian Linux 3.1 alpha
+ Debian Linux 3.1
LibTIFF LibTIFF 3.7.2
LibTIFF LibTIFF 3.7.0 Beta2
LibTIFF LibTIFF 3.7.0 Beta
LibTIFF LibTIFF 3.7.0 Alpha
LibTIFF LibTIFF 3.6.0 Beta2
LibTIFF LibTIFF 3.6.0 Beta
LibTIFF LibTIFF 3.5.7 Beta
LibTIFF LibTIFF 3.5.7 Alpha4
LibTIFF LibTIFF 3.5.7 Alpha3
LibTIFF LibTIFF 3.5.7 Alpha2
LibTIFF LibTIFF 3.5.7 Alpha
LibTIFF LibTIFF 3.5.6 Beta
LibTIFF LibTIFF 3.5.5
LibTIFF LibTIFF 3.5.4
LibTIFF LibTIFF 3.5.3
LibTIFF LibTIFF 3.5.1
LibTIFF LibTIFF 3.4 Beta37
LibTIFF LibTIFF 3.4 Beta36
LibTIFF LibTIFF 3.4 Beta35
LibTIFF LibTIFF 3.4 Beta34
LibTIFF LibTIFF 3.4 Beta32
LibTIFF LibTIFF 3.4 Beta31
LibTIFF LibTIFF 3.4 Beta29
LibTIFF LibTIFF 3.4 Beta28
LibTIFF LibTIFF 3.4 Beta24
LibTIFF LibTIFF 3.4 Beta18
LibTIFF LibTIFF 3.4
ImageMagick ImageMagick 6.6.8-5

不受影响系统

危害
远程攻击者可以利用漏洞以应用程序安全上下文执行任意代码。

攻击所需条件
攻击者必须构建恶意TIFF页，诱使用户解析。

漏洞信息
LibTiff是一款负责对TIFF图象格式进行编码/解码的应用库。
LibTiff处理畸形TIFF图像时，解析特制的"StripByteCounts"字段可触发基于栈的缓冲区溢出，成功利用漏洞可以以应用程序安全上下文执行任意代码。

测试方法
可参考如下测试程序：
http://home.ustc.edu.cn/~zgmzgm/malformed.tif

厂商解决方案
目前没有详细解决方案提供：
http://www.libtiff.org/

漏洞提供者
zgmzgm[at]mail.ustc.edu.cn