Vulnerability Name:

CVE-2006-2193 (CCN-26991)

Assigned:2006-06-07
Published:2006-06-07
Updated:2018-10-03
Summary:Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: Debian Bug report logs - #370355
libtiff-tools: tiff2pdf segfault

Source: CONFIRM
Type: UNKNOWN
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=370355

Source: CCN
Type: RemoteSensing Bugzilla Bug 1196
tiff2pdf dumps core when DocumentName contains UTF-8

Source: CONFIRM
Type: Exploit, Patch
http://bugzilla.remotesensing.org/show_bug.cgi?id=1196

Source: MITRE
Type: CNA
CVE-2006-2193

Source: SUSE
Type: UNKNOWN
SUSE-SR:2006:014

Source: CCN
Type: RHSA-2008-0848
Important: libtiff security and bug fix update

Source: CCN
Type: SA20488
LibTIFF tiff2pdf Buffer Overflow Vulnerability

Source: SECUNIA
Type: Patch, Vendor Advisory
20488

Source: SECUNIA
Type: UNKNOWN
20501

Source: SECUNIA
Type: UNKNOWN
20520

Source: SECUNIA
Type: UNKNOWN
20693

Source: SECUNIA
Type: UNKNOWN
20766

Source: SECUNIA
Type: UNKNOWN
21002

Source: CCN
Type: SA27181
Sun Solaris libtiff Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
27181

Source: CCN
Type: SA27222
Sun Solaris libtiff Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
27222

Source: CCN
Type: SA27832
Sun Solaris libTIFF Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
27832

Source: SECUNIA
Type: UNKNOWN
31670

Source: GENTOO
Type: UNKNOWN
GLSA-200607-03

Source: CCN
Type: Sun Alert ID: 103099
Multiple Security Vulnerabilities in the Solaris Tag Image File Format Library libtiff(3)

Source: CCN
Type: Sun Alert ID: 103160
Security Vulnerabilities in libtiff(3) May Allow Denial of Service (DoS) or Privilege Elevation

Source: SUNALERT
Type: UNKNOWN
103160

Source: SUNALERT
Type: UNKNOWN
201331

Source: CCN
Type: ASA-2007-440
Multiple Security Vulnerabilities in the Solaris Tag Image File Format Library libtiff(3) (Sun 103099)

Source: CCN
Type: ASA-2007-509
Security Vulnerabilities in libtiff(3) May Allow Denial of Service (DoS) or Privilege Elevation (Sun 103160)

Source: CCN
Type: ASA-2008-374
libtiff security and bug fix update (RHSA-2008-0848)

Source: DEBIAN
Type: Patch, Vendor Advisory
DSA-1091

Source: DEBIAN
Type: DSA-1091
tiff -- buffer overflows

Source: CCN
Type: GLSA-200607-03
libTIFF: Multiple buffer overflows

Source: MANDRIVA
Type: UNKNOWN
MDKSA-2006:102

Source: REDHAT
Type: UNKNOWN
RHSA-2008:0848

Source: CCN
Type: LibTIFF Web page
LibTIFF - TIFF Library and Utilities

Source: BID
Type: UNKNOWN
18331

Source: CCN
Type: BID-18331
LibTIFF tiff2pdf Remote Buffer Overflow Vulnerability

Source: CCN
Type: USN-289-1
tiff vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2006-2197

Source: VUPEN
Type: UNKNOWN
ADV-2007-3486

Source: VUPEN
Type: UNKNOWN
ADV-2007-4034

Source: XF
Type: UNKNOWN
libtiff-tiff2pdf-bo(26991)

Source: XF
Type: UNKNOWN
libtiff-tiff2pdf-bo(26991)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:9788

Source: UBUNTU
Type: UNKNOWN
USN-289-1

Source: SUSE
Type: SUSE-SR:2006:014
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:libtiff:libtiff:3.4:*:*:*:*:*:*:*
  • OR cpe:/a:libtiff:libtiff:3.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:libtiff:libtiff:3.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:libtiff:libtiff:3.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:libtiff:libtiff:3.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:libtiff:libtiff:3.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:libtiff:libtiff:3.5.6:*:*:*:*:*:*:*
  • OR cpe:/a:libtiff:libtiff:3.5.7:*:*:*:*:*:*:*
  • OR cpe:/a:libtiff:libtiff:3.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:libtiff:libtiff:3.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:libtiff:libtiff:3.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:libtiff:libtiff:3.7.1:*:*:*:*:*:*:*
  • OR cpe:/a:libtiff:libtiff:3.8.0:*:*:*:*:*:*:*
  • OR cpe:/a:libtiff:libtiff:3.8.1:*:*:*:*:*:*:*
  • OR cpe:/a:libtiff:libtiff:*:*:*:*:*:*:*:* (Version <= 3.8.2)

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:9788
    V
    		Buffer overflow in the t2p_write_pdf_string function in tiff2pdf in libtiff 3.8.2 and earlier allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a TIFF file with a DocumentName tag that contains UTF-8 characters, which triggers the overflow when a character is sign extended to an integer that produces more digits than expected in an sprintf call.
    2013-04-29
    oval:com.redhat.rhsa:def:20080848
    P
    		RHSA-2008:0848: libtiff security and bug fix update (Important)
    2008-08-28
    oval:org.debian:def:1091
    V
    		buffer overflows
    2006-06-08
    BACK
    libtiff libtiff 3.4
    libtiff libtiff 3.5.1
    libtiff libtiff 3.5.2
    libtiff libtiff 3.5.3
    libtiff libtiff 3.5.4
    libtiff libtiff 3.5.5
    libtiff libtiff 3.5.6
    libtiff libtiff 3.5.7
    libtiff libtiff 3.6.0
    libtiff libtiff 3.6.1
    libtiff libtiff 3.7.0
    libtiff libtiff 3.7.1
    libtiff libtiff 3.8.0
    libtiff libtiff 3.8.1
    libtiff libtiff *