Bug 1033109 (CVE-2017-7602)

Summary: VUL-0: CVE-2017-7602: tiff: signed integer overflow, which might cause a denial of service
Product: [Novell Products] SUSE Security Incidents Reporter: Victor Pereira <vpereira>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: mvetter, pgajdos, smash_bz
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/183192/
Whiteboard: CVSSv2:SUSE:CVE-2017-7602:2.6:(AV:N/AC:H/Au:N/C:N/I:N/A:P) CVSSv2:NVD:CVE-2017-7602:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) CVSSv3:NVD:CVE-2017-7602:7.8:(AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) CVSSv3:SUSE:CVE-2017-7602:5.3:(AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) CVSSv3:RedHat:CVE-2017-7602:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) maint:released:sle10-sp3:64045
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Victor Pereira 2017-04-10 05:52:57 UTC
CVE-2017-7602

LibTIFF 4.0.7 has a signed integer overflow, which might allow remote attackers
to cause a denial of service (application crash) or possibly have unspecified
other impact via a crafted image.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7602
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7602
Comment 1 Swamp Workflow Management 2017-09-26 13:09:08 UTC
SUSE-SU-2017:2569-1: An update that fixes 14 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1033109,1033111,1033112,1033113,1033118,1033120,1033126,1033127,1033128,1033129,1033131,1038438,1042804,1042805
CVE References: CVE-2016-10371,CVE-2017-7592,CVE-2017-7593,CVE-2017-7594,CVE-2017-7595,CVE-2017-7596,CVE-2017-7597,CVE-2017-7598,CVE-2017-7599,CVE-2017-7600,CVE-2017-7601,CVE-2017-7602,CVE-2017-9403,CVE-2017-9404
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    tiff-4.0.8-44.3.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    tiff-4.0.8-44.3.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    tiff-4.0.8-44.3.1
SUSE Linux Enterprise Server 12-SP3 (src):    tiff-4.0.8-44.3.1
SUSE Linux Enterprise Server 12-SP2 (src):    tiff-4.0.8-44.3.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    tiff-4.0.8-44.3.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    tiff-4.0.8-44.3.1
Comment 2 Swamp Workflow Management 2017-10-03 19:07:12 UTC
openSUSE-SU-2017:2635-1: An update that fixes 14 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1033109,1033111,1033112,1033113,1033118,1033120,1033126,1033127,1033128,1033129,1033131,1038438,1042804,1042805
CVE References: CVE-2016-10371,CVE-2017-7592,CVE-2017-7593,CVE-2017-7594,CVE-2017-7595,CVE-2017-7596,CVE-2017-7597,CVE-2017-7598,CVE-2017-7599,CVE-2017-7600,CVE-2017-7601,CVE-2017-7602,CVE-2017-9403,CVE-2017-9404
Sources used:
openSUSE Leap 42.3 (src):    tiff-4.0.8-21.1
openSUSE Leap 42.2 (src):    tiff-4.0.8-17.6.1
Comment 3 Petr Gajdos 2018-05-14 12:11:52 UTC
According to redhat bug:

upstream bug
http://bugzilla.maptools.org/show_bug.cgi?id=2650

upstream commit
https://github.com/vadz/libtiff/commit/66e7bd59520996740e4df5495a830b42fae48bc4
Comment 4 Petr Gajdos 2018-05-14 14:53:00 UTC
BEFORE

12/tiffcp

$ valgrind -q tiffcp -i 00121-libtiff-signintoverflow-tif_read /tmp/foo
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 11822 (0x2e2e) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 2609 (0xa31) encountered.
TIFFReadDirectory: Warning, Unknown field with tag 5113 (0x13f9) encountered.
TIFFFetchNormalTag: Warning, Sanity check on size of "DocumentName" value failed; tag ignored.
TIFFFetchNormalTag: Warning, Incorrect count for "XResolution"; tag ignored.
TIFFFetchNormalTag: Warning, IO error during reading of "Tag 2609"; tag ignored.
TIFFFetchNormalTag: Warning, Sanity check on size of "Tag 5113" value failed; tag ignored.
TIFFFillStrip: Read error on strip 0; got 9223372037257429372 bytes, expected 4.
[..]
IFFFillStrip: Read error on strip 0; got 9223372037257429372 bytes, expected 4.
TIFFFillStrip: Read error on strip 0; got 9223372037257429372 bytes, expected 4.
TIFFWriteDirectoryTagCheckedRational: Not-a-number value is illegal.
TIFFWriteDirectoryTagCheckedRational: Not-a-number value is illegal.
$

11/tiffcp

$ tiffcp -i 00121-libtiff-signintoverflow-tif_read /tmp/foo
00121-libtiff-signintoverflow-tif_read: This is a BigTIFF file.  This format not supported
by this version of libtiff..
$
[testcase does not work]


PATCH

https://github.com/vadz/libtiff/commit/66e7bd59520996740e4df5495a830b42fae48bc4

12/tiff:       fix already in due version update
10sp3,11/tiff: needs to be fixed; I believe they want to fix possible integer overflow in 

td->td_stripoffset[strip] + size > tif->tif_size

In 11/tiff, 'td->td_stripoffset[strip]' and 'tif->tif_size' is uint32, 'size' is int32. When we ensure 'size' is non-negative, I believe shifting the calculation to uint64_t will ensure that the check is correct, as also ensures that 
td->td_stripoffset[strip] + size is below uint32 maximum. Feel free to double check.


AFTER

11/tiffcp

$ 00121-libtiff-signintoverflow-tif_read: This is a BigTIFF file.  This format not supported
by this version of libtiff..
$
[the testcase does not work]
Comment 5 Petr Gajdos 2018-05-14 14:53:46 UTC
Will submit for 11/tiff and 10sp3/tiff.
Comment 7 Petr Gajdos 2018-05-18 11:09:09 UTC
Packages submitted:
12/tiff:    165341
11/tiff:    165349
10sp3/tiff: 165350

@Michael, after you review these requests and after you accept and resubmit packages in case everything's ok, I think you can reassign this bug to security-team@.
Comment 8 Michael Vetter 2018-05-22 09:19:28 UTC
Thanks a lot Petr! All perfect.

SR#165480 to SLE12.
SR#165482 to SLE11.
SR#165483 to SLE10.
Comment 10 Swamp Workflow Management 2018-05-30 09:06:00 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2018-06-13.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/64044
Comment 11 Swamp Workflow Management 2018-05-30 13:14:16 UTC
SUSE-SU-2018:1472-1: An update that solves 14 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1017694,1031250,1031254,1033109,1033111,1033112,1033113,1033120,1033126,1033127,1033129,1074317,984808,984809,984831,987351
CVE References: CVE-2016-10267,CVE-2016-10269,CVE-2016-10270,CVE-2016-5314,CVE-2016-5315,CVE-2017-18013,CVE-2017-7593,CVE-2017-7595,CVE-2017-7596,CVE-2017-7597,CVE-2017-7599,CVE-2017-7600,CVE-2017-7601,CVE-2017-7602
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    tiff-3.8.2-141.169.6.1
SUSE Linux Enterprise Server 11-SP4 (src):    tiff-3.8.2-141.169.6.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    tiff-3.8.2-141.169.6.1
Comment 12 Marcus Meissner 2019-01-14 08:06:26 UTC
done