Bug 1046770 – VUL-1: CVE-2017-10688: tiff: Assertion abort in TIFFWriteDirectoryTagCheckedLong8Array allowing for remote denial of service attack

Bug 1046770 - (CVE-2017-10688) VUL-1: CVE-2017-10688: tiff: Assertion abort in TIFFWriteDirectoryTagCheckedLong8Array allowing for remote denial of service attack

(CVE-2017-10688)
Summary:	VUL-1: CVE-2017-10688: tiff: Assertion abort in TIFFWriteDirectoryTagCheckedL...

Status:	RESOLVED FIXED

Classification:	Novell Products
Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents
Version:	unspecified
Hardware:	Other Other

Priority:	P4 - Low Severity: Normal
Target Milestone:	---
Assigned To:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/187636/
Whiteboard:	CVSSv3:SUSE:CVE-2017-10688:5.3:(AV:N/...
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2017-06-30 06:30 UTC by Johannes Segitz
Modified:	2018-12-01 07:29 UTC (History)
CC List:	3 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Reproducer (5.51 KB, image/tiff) 2017-06-30 06:30 UTC, Johannes Segitz	Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Johannes Segitz 2017-06-30 06:30:14 UTC

Created attachment 730818 [details]
Reproducer

CVE-2017-10688

In LibTIFF 4.0.8, there is a assertion abort in the
TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. A crafted
input will lead to a remote denial of service attack.

Reproducer: tiffset POC1

Triggered for me once on SLE 12, but not anymore after that. Kind of strange, please have a look

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-10688
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10688
http://bugzilla.maptools.org/show_bug.cgi?id=2712

Comment 1 Petr Gajdos 2018-05-15 17:49:51 UTC

BEFORE

12/tiff

$ tiffset POC1
POC1: Failed to allocate memory for to read TIFF directory (0 elements of 12 bytes each).
TIFFReadDirectory: Failed to read directory at offset 5356.
$

11/tiff

$ tiffset POC1
POC1: No space to read TIFF directory.
$


PATCH

https://gitlab.com/libtiff/libtiff/commit/3cb621f5cff48202c890c3c028ffbd8517962c4f

12/tiff: fix is already in by version update
11/tiff: no such code found