First Last Prev Next    This bug is not in your last search results.
Bug 1074317 - (CVE-2017-18013) VUL-0: CVE-2017-18013: tiff: A Null-Pointer Dereference in the tif_print.cTIFFPrintDirectory function, could lead to denial of service
(CVE-2017-18013)
VUL-0: CVE-2017-18013: tiff: A Null-Pointer Dereference in the tif_print.cTIF...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/197452/
CVSSv3:RedHat:CVE-2017-18013:7.5:(AV:...
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2018-01-02 10:57 UTC by Victor Pereira
Modified: 2018-07-13 22:38 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
tiff_npd (286 bytes, application/octet-stream)
2018-01-17 16:57 UTC, Marcus Meissner 		Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2018-01-02 10:57:40 UTC 
CVE-2017-18013

In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the tif_print.c
TIFFPrintDirectory function, as demonstrated by a tiffinfo crash.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-18013
http://www.cvedetails.com/cve/CVE-2017-18013/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18013
https://gitlab.com/libtiff/libtiff/commit/c6f41df7b581402dfba3c19a1e3df4454c551a01
http://bugzilla.maptools.org/show_bug.cgi?id=2770
Comment 1 Marcus Meissner 2018-01-17 16:57:14 UTC 
Created attachment 756485 [details]
tiff_npd

QA REPRODUCER:

tiffinfo -s tiff_npd

should not crash
Comment 2 Petr Gajdos 2018-05-18 09:16:21 UTC 
12,devel/tiff

$ tiffinfo -s tiff_npd 
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 12336 (0x3030) encountered.
TIFFReadDirectory: Warning, Photometric tag is missing, assuming data is YCbCr.
TIFFReadDirectory: Warning, BitsPerSample tag is missing, assuming 8 bits per sample.
TIFFReadDirectory: Warning, SamplesPerPixel tag is missing, applying correct SamplesPerPixel value of 3.
TIFF Directory at offset 0x8 (8)
  Image Width: 12336 Image Length: 12336
  Bits/Sample: 8
  Compression Scheme: Old-style JPEG
  Photometric Interpretation: YCbCr
  YCbCr Subsampling: 2, 2
  Samples/Pixel: 3
  Planar Configuration: single image plane
  1 Strips:
Segmentation fault (core dumped)
$

11/tiff

$ tiffinfo -s tiff_npd 
TIFFReadDirectory: Warning, tiff_npd: unknown field with tag 12336 (0x3030) encountered.
TIFFReadDirectory: Warning, tiff_npd: invalid TIFF directory; tags are not sorted in ascending order.
tiff_npd: Warning, incorrect count for field "StripOffsets" (808464432, expecting 1); tag trimmed.
tiff_npd: No space to fetch strip tag.
$


PATCH

in comment 0

10sp3,11/tiff: code partially in, I think it needs to be patched; I have not found that td->td_stripbytecount or td->td_stripoffset would explicitely be set to NULL somewhere in 4.0.9

AFTER


12,devel/tiff

$ tiffinfo -s tiff_npd 
TIFFReadDirectoryCheckOrder: Warning, Invalid TIFF directory; tags are not sorted in ascending order.
TIFFReadDirectory: Warning, Unknown field with tag 12336 (0x3030) encountered.
TIFFReadDirectory: Warning, Photometric tag is missing, assuming data is YCbCr.
TIFFReadDirectory: Warning, BitsPerSample tag is missing, assuming 8 bits per sample.
TIFFReadDirectory: Warning, SamplesPerPixel tag is missing, applying correct SamplesPerPixel value of 3.
TIFF Directory at offset 0x8 (8)
  Image Width: 12336 Image Length: 12336
  Bits/Sample: 8
  Compression Scheme: Old-style JPEG
  Photometric Interpretation: YCbCr
  YCbCr Subsampling: 2, 2
  Samples/Pixel: 3
  Planar Configuration: single image plane
  1 Strips:
      0: [808464432,        0]
$
[no crash]

11/tiff

$ valgrind -q tiffinfo -s tiff_npd
TIFFReadDirectory: Warning, tiff_npd: unknown field with tag 12336 (0x3030) encountered.
TIFFReadDirectory: Warning, tiff_npd: invalid TIFF directory; tags are not sorted in ascending order.
tiff_npd: Warning, incorrect count for field "StripOffsets" (808464432, expecting 1); tag trimmed.
tiff_npd: No space to fetch strip tag.
$
[no change]
Comment 3 Petr Gajdos 2018-05-18 09:21:54 UTC 
Will submit for Tumbleweed/tiff, 12/tiff, 11/tif and 10sp3/tiff.

@Michael, could you please forward sr#610254 to Tumbleweed and SLE15.
Comment 4 Petr Gajdos 2018-05-18 11:08:59 UTC 
Packages submitted:
12/tiff:    165341
11/tiff:    165349
10sp3/tiff: 165350

@Michael, after you review these requests and after you accept and resubmit packages in case everything's ok, I think you can reassign this bug to security-team@.
Comment 5 Michael Vetter 2018-05-22 09:10:40 UTC 
Thanks a lot Petr! All perfect.

SR#610255 to TW.
SR#165481 to SLE15.
SR#165480 to SLE12.
SR#165482 to SLE11.
SR#165483 to SLE10.
Comment 7 Swamp Workflow Management 2018-05-30 09:05:50 UTC 
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2018-06-13.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/64044
Comment 8 Swamp Workflow Management 2018-05-30 13:15:39 UTC 
SUSE-SU-2018:1472-1: An update that solves 14 vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 1017694,1031250,1031254,1033109,1033111,1033112,1033113,1033120,1033126,1033127,1033129,1074317,984808,984809,984831,987351
CVE References: CVE-2016-10267,CVE-2016-10269,CVE-2016-10270,CVE-2016-5314,CVE-2016-5315,CVE-2017-18013,CVE-2017-7593,CVE-2017-7595,CVE-2017-7596,CVE-2017-7597,CVE-2017-7599,CVE-2017-7600,CVE-2017-7601,CVE-2017-7602
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    tiff-3.8.2-141.169.6.1
SUSE Linux Enterprise Server 11-SP4 (src):    tiff-3.8.2-141.169.6.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    tiff-3.8.2-141.169.6.1
Comment 13 Swamp Workflow Management 2018-06-27 16:10:15 UTC 
SUSE-SU-2018:1826-1: An update that fixes 8 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1007276,1074317,1082332,1082825,1086408,1092949,974621
CVE References: CVE-2016-3632,CVE-2016-8331,CVE-2017-11613,CVE-2017-13726,CVE-2017-18013,CVE-2018-10963,CVE-2018-7456,CVE-2018-8905
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP3 (src):    tiff-4.0.9-44.15.2
SUSE Linux Enterprise Server 12-SP3 (src):    tiff-4.0.9-44.15.2
SUSE Linux Enterprise Desktop 12-SP3 (src):    tiff-4.0.9-44.15.2
Comment 14 Swamp Workflow Management 2018-06-28 13:08:40 UTC 
openSUSE-SU-2018:1834-1: An update that fixes 8 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1007276,1074317,1082332,1082825,1086408,1092949,974621
CVE References: CVE-2016-3632,CVE-2016-8331,CVE-2017-11613,CVE-2017-13726,CVE-2017-18013,CVE-2018-10963,CVE-2018-7456,CVE-2018-8905
Sources used:
openSUSE Leap 42.3 (src):    tiff-4.0.9-31.1
Comment 15 Swamp Workflow Management 2018-07-05 10:16:59 UTC 
SUSE-SU-2018:1889-1: An update that fixes 5 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1074317,1082332,1082825,1086408,1092949
CVE References: CVE-2017-11613,CVE-2017-18013,CVE-2018-10963,CVE-2018-7456,CVE-2018-8905
Sources used:
SUSE Linux Enterprise Module for Desktop Applications 15 (src):    tiff-4.0.9-5.9.1
SUSE Linux Enterprise Module for Basesystem 15 (src):    tiff-4.0.9-5.9.1
Comment 16 Andreas Stieger 2018-07-13 18:06:33 UTC 
done
Comment 17 Swamp Workflow Management 2018-07-13 22:09:22 UTC 
openSUSE-SU-2018:1956-1: An update that fixes 5 vulnerabilities is now available.

Category: security (moderate)
Bug References: 1074317,1082332,1082825,1086408,1092949
CVE References: CVE-2017-11613,CVE-2017-18013,CVE-2018-10963,CVE-2018-7456,CVE-2018-8905
Sources used:
openSUSE Leap 15.0 (src):    tiff-4.0.9-lp150.4.3.1
First Last Prev Next    This bug is not in your last search results.