Bug 1076182 (CVE-2017-18028)

Summary:	VUL-1: CVE-2017-18028: GraphicsMagick,ImageMagick: memory exhaustion in the function ReadTIFFImage in coders/tiff.c
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Marcus Meissner <meissner>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Minor
Priority:	P4 - Low	CC:	astieger, pgajdos, smash_bz
Version:	unspecified
Target Milestone:	unspecified
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/198184/
Whiteboard:	CVSSv2:NVD:CVE-2017-18028:7.1:(AV:N/AC:M/Au:N/C:N/I:N/A:C) CVSSv3:NVD:CVE-2017-18028:6.5:(AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) CVSSv3:RedHat:CVE-2017-18028:3.3:(AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Attachments:	memory_exhaustion_in_ReadTIFFImage_1934

Description Marcus Meissner 2018-01-16 12:08:17 UTC

rh#1534736

In ImageMagick 7.0.7-1 Q16, a memory exhaustion vulnerability was found in the
function ReadTIFFImage in coders/tiff.c, which allow remote attackers to cause a
denial of service via a crafted file.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1534736
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-18028
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-18028.html
https://github.com/ImageMagick/ImageMagick/issues/736

Comment 1 Marcus Meissner 2018-01-16 12:47:52 UTC

Created attachment 756237 [details]
memory_exhaustion_in_ReadTIFFImage_1934

QA REPRODUCER:

convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null

gm convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null

Comment 2 Marcus Meissner 2018-01-16 12:49:34 UTC

does not seen to trigger on SLE11 or Leap(SLE12) IM/GM.

Comment 3 Petr Gajdos 2018-01-30 11:53:18 UTC

BEFORE

12/ImageMagick

$ valgrind -q convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
convert: Invalid TIFF directory; tags are not sorted in ascending order. `TIFFReadDirectoryCheckOrder' @ warning/tiff.c/TIFFWarnings/883.
convert: Nonstandard tile length 808452097, convert file. `memory_exhaustion_in_ReadTIFFImage_1934' @ warning/tiff.c/TIFFWarnings/883.
convert: memory allocation failed `memory_exhaustion_in_ReadTIFFImage_1934' @ error/tiff.c/ReadTIFFImage/1660.
convert: no images defined `/dev/null' @ error/convert.c/ConvertImageCommand/3149.
$

11/ImageMagick

$ valgrind -q convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
convert: Nonstandard tile length 808452097, convert file. `memory_exhaustion_in_ReadTIFFImage_1934'.
convert: memory_exhaustion_in_ReadTIFFImage_1934: invalid TIFF directory; tags are not sorted in ascending order. `TIFFReadDirectory'.
convert: Integer overflow in TIFFVTileSize. `memory_exhaustion_in_ReadTIFFImage_1934'.
convert: memory_exhaustion_in_ReadTIFFImage_1934: cannot handle zero tile size. `TIFFReadDirectory'.
convert: missing an image filename `/dev/null'.
$

11/GraphicsMagick

$ valgrind -q gm convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
gm convert: memory_exhaustion_in_ReadTIFFImage_1934: cannot handle zero tile size. (TIFFReadDirectory).
$

42.3/GraphicsMagick

$ valgrind -q gm convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
gm convert: Memory allocation failed (memory_exhaustion_in_ReadTIFFImage_1934).
$

No issue observed.

PATCH

ImageMagick:
https://github.com/ImageMagick/ImageMagick/commit/740985d9bd3f1c50d622c3496bb2e75d44b65a91
Things like WidthResource or HeightResource are not available in older versions, though.

GraphicsMagick:
http://hg.code.sf.net/p/graphicsmagick/code/rev/752c0b41fa32

AFTER

12/ImageMagick

$ valgrind -q convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
convert: Invalid TIFF directory; tags are not sorted in ascending order. `TIFFReadDirectoryCheckOrder' @ warning/tiff.c/TIFFWarnings/883.
convert: Nonstandard tile length 808452097, convert file. `memory_exhaustion_in_ReadTIFFImage_1934' @ warning/tiff.c/TIFFWarnings/883.
convert: memory allocation failed `memory_exhaustion_in_ReadTIFFImage_1934' @ error/tiff.c/ReadTIFFImage/1645.
convert: no images defined `/dev/null' @ error/convert.c/ConvertImageCommand/3149.
$
[no change]

11/ImageMagick

$ valgrind -q convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
convert: Nonstandard tile length 808452097, convert file. `memory_exhaustion_in_ReadTIFFImage_1934'.
convert: memory_exhaustion_in_ReadTIFFImage_1934: invalid TIFF directory; tags are not sorted in ascending order. `TIFFReadDirectory'.
convert: Integer overflow in TIFFVTileSize. `memory_exhaustion_in_ReadTIFFImage_1934'.
convert: memory_exhaustion_in_ReadTIFFImage_1934: cannot handle zero tile size. `TIFFReadDirectory'.
convert: missing an image filename `/dev/null'.
$
[no change]

42.3/GraphicsMagick

$ valgrind -q gm convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
gm convert: Memory allocation failed (memory_exhaustion_in_ReadTIFFImage_1934).
$
[no change]

11/GraphicsMagick

$ valgrind -q gm convert memory_exhaustion_in_ReadTIFFImage_1934 /dev/null
gm convert: memory_exhaustion_in_ReadTIFFImage_1934: cannot handle zero tile size. (TIFFReadDirectory).
$
[no change]

Comment 4 Petr Gajdos 2018-01-30 11:54:48 UTC

Will submit for 12/ImageMagick, 11/ImageMagick, 11/GraphicsMagick and 42.3/GraphicsMagick.

Comment 5 Petr Gajdos 2018-02-02 09:31:17 UTC

I believe all fixed.

Comment 6 Swamp Workflow Management 2018-02-09 16:30:26 UTC

This is an autogenerated message for OBS integration:
This bug (1076182) was mentioned in
https://build.opensuse.org/request/show/574758 42.3 / GraphicsMagick

Comment 7 Swamp Workflow Management 2018-02-12 09:30:29 UTC

This is an autogenerated message for OBS integration:
This bug (1076182) was mentioned in
https://build.opensuse.org/request/show/575511 42.3 / GraphicsMagick

Comment 8 Swamp Workflow Management 2018-02-16 11:16:25 UTC

openSUSE-SU-2018:0460-1: An update that fixes 7 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1047900,1049374,1051411,1058009,1073081,1074307,1076182
CVE References: CVE-2017-11140,CVE-2017-11450,CVE-2017-11722,CVE-2017-14224,CVE-2017-17502,CVE-2017-17912,CVE-2017-18028
Sources used:
openSUSE Leap 42.3 (src):    GraphicsMagick-1.3.25-68.1

Comment 9 Swamp Workflow Management 2018-02-20 14:11:02 UTC

SUSE-SU-2018:0486-1: An update that fixes 24 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1042824,1048110,1049374,1049375,1050048,1050617,1050669,1052207,1052248,1052251,1052254,1052472,1052688,1052711,1052747,1052750,1052761,1055069,1055229,1058009,1074119,1076182,1078433
CVE References: CVE-2017-11166,CVE-2017-11448,CVE-2017-11450,CVE-2017-11537,CVE-2017-11637,CVE-2017-11638,CVE-2017-11642,CVE-2017-12418,CVE-2017-12427,CVE-2017-12429,CVE-2017-12432,CVE-2017-12566,CVE-2017-12654,CVE-2017-12664,CVE-2017-12665,CVE-2017-12668,CVE-2017-12674,CVE-2017-13058,CVE-2017-13131,CVE-2017-14224,CVE-2017-17885,CVE-2017-18028,CVE-2017-9407,CVE-2018-6405
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.34.1
SUSE Linux Enterprise Server 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.34.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    ImageMagick-6.4.3.6-7.78.34.1

Comment 10 Swamp Workflow Management 2018-02-22 14:10:52 UTC

SUSE-SU-2018:0524-1: An update that fixes 20 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1042824,1047900,1049374,1049375,1050617,1050669,1052248,1052251,1052254,1052472,1052688,1055069,1055229,1058009,1072934,1073081,1074307,1076182,1078433
CVE References: CVE-2017-11140,CVE-2017-11448,CVE-2017-11450,CVE-2017-11637,CVE-2017-11638,CVE-2017-11642,CVE-2017-12427,CVE-2017-12429,CVE-2017-12432,CVE-2017-12566,CVE-2017-12668,CVE-2017-13058,CVE-2017-13131,CVE-2017-14224,CVE-2017-17502,CVE-2017-17503,CVE-2017-17912,CVE-2017-18028,CVE-2017-9407,CVE-2018-6405
Sources used:
SUSE Studio Onsite 1.3 (src):    GraphicsMagick-1.2.5-4.78.38.1
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.38.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    GraphicsMagick-1.2.5-4.78.38.1

Comment 11 Swamp Workflow Management 2018-03-01 20:19:12 UTC

SUSE-SU-2018:0581-1: An update that fixes 35 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1042824,1042911,1048110,1048272,1049374,1049375,1050048,1050119,1050122,1050126,1050132,1050617,1052207,1052248,1052251,1052254,1052472,1052688,1052711,1052747,1052750,1052754,1052761,1055069,1055229,1056768,1057163,1058009,1072898,1074119,1074170,1075821,1076182,1078433
CVE References: CVE-2017-11166,CVE-2017-11170,CVE-2017-11448,CVE-2017-11450,CVE-2017-11528,CVE-2017-11530,CVE-2017-11531,CVE-2017-11533,CVE-2017-11537,CVE-2017-11638,CVE-2017-11642,CVE-2017-12418,CVE-2017-12427,CVE-2017-12429,CVE-2017-12432,CVE-2017-12566,CVE-2017-12654,CVE-2017-12663,CVE-2017-12664,CVE-2017-12665,CVE-2017-12668,CVE-2017-12674,CVE-2017-13058,CVE-2017-13131,CVE-2017-14060,CVE-2017-14139,CVE-2017-14224,CVE-2017-17682,CVE-2017-17885,CVE-2017-17934,CVE-2017-18028,CVE-2017-9405,CVE-2017-9407,CVE-2018-5357,CVE-2018-6405
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP3 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Workstation Extension 12-SP2 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Server 12-SP3 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Server 12-SP2 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Desktop 12-SP3 (src):    ImageMagick-6.8.8.1-71.42.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ImageMagick-6.8.8.1-71.42.1

Comment 12 Andreas Stieger 2018-03-06 19:44:29 UTC

Releasing for Leap, showing as done otherwise

Comment 13 Swamp Workflow Management 2018-03-06 23:17:45 UTC

openSUSE-SU-2018:0621-1: An update that fixes 35 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1042824,1042911,1048110,1048272,1049374,1049375,1050048,1050119,1050122,1050126,1050132,1050617,1052207,1052248,1052251,1052254,1052472,1052688,1052711,1052747,1052750,1052754,1052761,1055069,1055229,1056768,1057163,1058009,1072898,1074119,1074170,1075821,1076182,1078433
CVE References: CVE-2017-11166,CVE-2017-11170,CVE-2017-11448,CVE-2017-11450,CVE-2017-11528,CVE-2017-11530,CVE-2017-11531,CVE-2017-11533,CVE-2017-11537,CVE-2017-11638,CVE-2017-11642,CVE-2017-12418,CVE-2017-12427,CVE-2017-12429,CVE-2017-12432,CVE-2017-12566,CVE-2017-12654,CVE-2017-12663,CVE-2017-12664,CVE-2017-12665,CVE-2017-12668,CVE-2017-12674,CVE-2017-13058,CVE-2017-13131,CVE-2017-14060,CVE-2017-14139,CVE-2017-14224,CVE-2017-17682,CVE-2017-17885,CVE-2017-17934,CVE-2017-18028,CVE-2017-9405,CVE-2017-9407,CVE-2018-5357,CVE-2018-6405
Sources used:
openSUSE Leap 42.3 (src):    ImageMagick-6.8.8.1-55.1

Comment 14 Petr Gajdos 2018-04-24 15:10:34 UTC

Please note that GraphicsMagick will reference CVE-2017-18229 (bug 1085236) from now on. Therefore, this bug is ImageMagick only.

Comment 15 Marcus Meissner 2018-05-18 15:44:07 UTC

released