Bug 975069 (CVE-2016-3990)

Summary: VUL-1: CVE-2016-3990: tiff: out-of-bounds write in horizontalDifference8() in tiffcp tool
Product: [Novell Products] SUSE Security Incidents Reporter: Johannes Segitz <jsegitz>
Component: IncidentsAssignee: Fridrich Strba <fstrba>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Minor    
Priority: P4 - Low CC: astieger
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard: CVSSv2:SUSE:CVE-2016-3990:7.5:(AV:N/AC:L/Au:N/C:P/I:P/A:P) CVSSv2:RedHat:CVE-2016-3990:6.8:(AV:N/AC:M/Au:N/C:P/I:P/A:P) maint:running:63129:moderate
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Johannes Segitz 2016-04-12 08:34:40 UTC
Details

============

Product: libtiff
Affected Versions: <= 4.0.6
CVE ID: CVE-2016-3990
Tested system: CentOS Linux release 7.1.1503 64bit
Vulnerability Type: out-of-bounds write
Vendor URL: http://www.remotesensing.org/libtiff/
Credit: Kaixiang Zhang of the Cloud Security Team, Qihoo 360

Introduction
============
An out-of-bounds write flaw was found in libtiff v4.0.6 when using tiffcp command to handle malicious tiff file. The vulnerability exist in function horizontalDifference8()
without checking the buffer length.An attacker could control the head data of next heap which contains pre_size field and size filed to result in DoS or may command execution..

Source info
============
1082           wp += n + stride - 1;     /* point to last one */
1083           ip += n + stride - 1;       /* point to last one */
1084           n -= stride;
1085           while (n > 0) {
1086              REPEAT(stride, wp[0] = CLAMP(ip[0]);
1087                            wp[stride] -= wp[0];
1088                            wp[stride] &= mask;
1089                            wp--; ip--)
1090              n -= stride;
1091           }
1092           REPEAT(stride, wp[0] = CLAMP(ip[0]); wp--; ip--)

Debug info
============
gdb ?Cargs ./tiffcp poc.tif src1.tif tmpout.tif
--- --- ---
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff6f943b9 in _int_free () from /lib64/libc.so.6
(gdb) bt
#0  0x00007ffff6f943b9 in _int_free () from /lib64/libc.so.6
#1  0x00007ffff7a52721 in TIFFClose (tif=tif@entry=0x625930) at tif_close.c:128
#2  0x0000000000405160 in main (argc=3, argv=0x7fffffffe3b8) at tiffcp.c:305
(gdb) x/2xg 0x625930-0x10
0x625920:        0x00000000000000f0      0x0000000000000450
(gdb) x/2xg 0x625930-0x10-0xf0
0x625830:       0x0000000000040004     0x0000000003370424
Comment 1 Swamp Workflow Management 2016-04-12 22:00:13 UTC
bugbot adjusting priority
Comment 2 Swamp Workflow Management 2016-09-09 12:10:34 UTC
openSUSE-SU-2016:2275-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 974614,974618,975069,975070
CVE References: CVE-2016-3623,CVE-2016-3945,CVE-2016-3990,CVE-2016-3991
Sources used:
openSUSE 13.2 (src):    tiff-4.0.6-10.29.1
Comment 3 Swamp Workflow Management 2016-09-25 10:09:20 UTC
openSUSE-SU-2016:2375-1: An update that fixes 9 vulnerabilities is now available.

Category: security (moderate)
Bug References: 974614,974618,975069,975070,984808,984831,984837,984842,987351
CVE References: CVE-2016-3623,CVE-2016-3945,CVE-2016-3990,CVE-2016-3991,CVE-2016-5314,CVE-2016-5316,CVE-2016-5317,CVE-2016-5320,CVE-2016-5875
Sources used:
openSUSE 13.1 (src):    tiff-4.0.6-8.25.1
Comment 4 Swamp Workflow Management 2016-10-12 13:15:33 UTC
SUSE-SU-2016:2508-1: An update that fixes 5 vulnerabilities is now available.

Category: security (moderate)
Bug References: 974449,974614,974618,975069,975070
CVE References: CVE-2016-3622,CVE-2016-3623,CVE-2016-3945,CVE-2016-3990,CVE-2016-3991
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    tiff-4.0.6-31.1
SUSE Linux Enterprise Server 12-SP1 (src):    tiff-4.0.6-31.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    tiff-4.0.6-31.1
Comment 6 Swamp Workflow Management 2016-10-13 15:09:54 UTC
openSUSE-SU-2016:2525-1: An update that fixes 5 vulnerabilities is now available.

Category: security (moderate)
Bug References: 974449,974614,974618,975069,975070
CVE References: CVE-2016-3622,CVE-2016-3623,CVE-2016-3945,CVE-2016-3990,CVE-2016-3991
Sources used:
openSUSE Leap 42.1 (src):    tiff-4.0.6-9.1
Comment 7 Swamp Workflow Management 2016-10-13 15:11:51 UTC
SUSE-SU-2016:2527-1: An update that fixes 10 vulnerabilities is now available.

Category: security (moderate)
Bug References: 973340,974449,974614,974618,975069,984808,984831,984837,984842,987351
CVE References: CVE-2016-3186,CVE-2016-3622,CVE-2016-3623,CVE-2016-3945,CVE-2016-3990,CVE-2016-5314,CVE-2016-5316,CVE-2016-5317,CVE-2016-5320,CVE-2016-5875
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    tiff-3.8.2-141.168.1
SUSE Linux Enterprise Server 11-SP4 (src):    tiff-3.8.2-141.168.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    tiff-3.8.2-141.168.1