Vulnerability CVE-2004-1308 - CERT Civis.Net

Vulnerability Name:

CVE-2004-1308 (CCN-18637)

Assigned:

2004-12-21

Published:

2004-12-21

Updated:

2017-10-11

Summary:

Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: Sun Alert ID: 57769
Multiple Security Vulnerabilities in libtiff(3)

Source: MITRE
Type: CNA
CVE-2004-1308

Source: CONECTIVA
Type: UNKNOWN
CLA-2005:920

Source: CCN
Type: AppleCare Knowledge Base Document 301528
Security Update 2005-005

Source: APPLE
Type: UNKNOWN
APPLE-SA-2005-05-03

Source: CCN
Type: RHSA-2005-019
libtiff security update

Source: CCN
Type: RHSA-2005-021
kdegraphics security update

Source: CCN
Type: RHSA-2005-035
libtiff security update

Source: SECUNIA
Type: UNKNOWN
13776

Source: SUNALERT
Type: UNKNOWN
101677

Source: CCN
Type: Sun Alert ID: 201072
Multiple Security Vulnerabilities in libtiff(3)

Source: SUNALERT
Type: UNKNOWN
201072

Source: CCN
Type: CIAC Information Bulletin P-082
'tiff' Insufficient Input Validation

Source: DEBIAN
Type: UNKNOWN
DSA-617

Source: DEBIAN
Type: DSA-617
tiff -- insufficient input validation

Source: CCN
Type: GLSA-200501-06
tiff: New overflows in image decoding

Source: CCN
Type: iDEFENSE Security Advisory 12.21.04
libtiff Directory Entry Count Integer Overflow Vulnerability

Source: IDEFENSE
Type: Exploit, Patch, Vendor Advisory
20041221 libtiff Directory Entry Count Integer Overflow Vulnerability

Source: CCN
Type: US-CERT VU#125598
LibTIFF vulnerable to integer overflow via corrupted directory entry count

Source: CERT-VN
Type: US Government Resource
VU#125598

Source: CCN
Type: LibTIFF Web site
LibTIFF - TIFF Library and Utilities

Source: MANDRAKE
Type: UNKNOWN
MDKSA-2005:052

Source: SUSE
Type: UNKNOWN
SUSE-SA:2005:001

Source: REDHAT
Type: UNKNOWN
RHSA-2005:019

Source: REDHAT
Type: UNKNOWN
RHSA-2005:035

Source: CCN
Type: BID-12075
LibTIFF Heap Corruption Integer Overflow Vulnerabilities

Source: CCN
Type: TLSA-2005-4
Multiple vulnerabilities in libtiff

Source: CCN
Type: USN-46-1
TIFF library vulnerability

Source: CERT
Type: US Government Resource
TA05-136A

Source: XF
Type: UNKNOWN
libtiff-tiff-tdircount-bo(18637)

Source: XF
Type: UNKNOWN
libtiff-tiff-tdircount-bo(18637)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:100117

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:9392

Source: SUSE
Type: SUSE-SA:2005:001
libtiff/tiff: remote system compromise

Vulnerable Configuration:

Configuration 1:

cpe:/a:libtiff:libtiff:3.4:*:*:*:*:*:*:*

OR cpe:/a:libtiff:libtiff:3.5.1:*:*:*:*:*:*:*

OR cpe:/a:libtiff:libtiff:3.5.2:*:*:*:*:*:*:*

OR cpe:/a:libtiff:libtiff:3.5.3:*:*:*:*:*:*:*

OR cpe:/a:libtiff:libtiff:3.5.4:*:*:*:*:*:*:*

OR cpe:/a:libtiff:libtiff:3.5.5:*:*:*:*:*:*:*

OR cpe:/a:libtiff:libtiff:3.5.7:*:*:*:*:*:*:*

OR cpe:/a:libtiff:libtiff:3.6.0:*:*:*:*:*:*:*

OR cpe:/a:libtiff:libtiff:3.6.1:*:*:*:*:*:*:*

OR cpe:/a:libtiff:libtiff:3.7.0:*:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/o:sun:solaris:7.0::x86:*:*:*:*:*

OR cpe:/o:sun:solaris:7.0::sparc:*:*:*:*:*

OR cpe:/o:sun:solaris:8::x86:*:*:*:*:*

OR cpe:/o:sun:solaris:8::sparc:*:*:*:*:*

OR cpe:/o:sun:solaris:9::x86:*:*:*:*:*

OR cpe:/o:sun:solaris:10::sparc:*:*:*:*:*

OR cpe:/o:sun:solaris:10::x86:*:*:*:*:*

OR cpe:/o:sun:solaris:9::sparc:*:*:*:*:*

AND

cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:*

OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:8.1:*:*:*:*:*:*:*

OR cpe:/o:suse:linux_enterprise_server:8:*:*:*:*:*:*:*

OR cpe:/a:mandrakesoft:mandrake_multi_network_firewall:8.2:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*

OR cpe:/o:suse:suse_linux:8.2:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:2.1:*:aw:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:9.2:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.1:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*

OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

OR cpe:/o:novell:linux_desktop:9:*:*:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

OR cpe:/o:apple:mac_os_x:10.3.9:*:*:*:*:*:*:*

OR cpe:/o:apple:mac_os_x_server:10.3.9:*:*:*:*:*:*:*

OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*

OR cpe:/o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:10.1::x86-64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*

OR cpe:/o:turbolinux:turbolinux:*:*:home:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:9.2::amd64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux:10.0::amd64:*:*:*:*:*

OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1::x86_64:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:9392	V	Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for libtiff 3.5.7 and 3.7.0 allows remote attackers to execute arbitrary code via a TIFF file containing a TIFF_ASCII or TIFF_UNDEFINED directory entry with a -1 entry count, which leads to a heap-based buffer overflow.	2013-04-29
oval:org.mitre.oval:def:100117	V	libtiff Directory Entry Count Integer Overflow Vulnerability	2005-11-16
oval:com.redhat.rhsa:def:20050021	P	RHSA-2005:021: kdegraphics security update (Moderate)	2005-04-14
oval:com.redhat.rhsa:def:20050035	P	RHSA-2005:035: libtiff security update (Important)	2005-02-15
oval:com.redhat.rhsa:def:20050019	P	RHSA-2005:019: libtiff security update (Important)	2005-01-13
oval:org.debian:def:617	V	insufficient input validation	2004-12-24