Bug 610786 (CVE-2010-2598)

Summary: CVE-2010-2598 libtiff: crash when reading image with not configured compression
Product: [Other] Security Response Reporter: Jan Lieskovsky <jlieskov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: erik-fedora, ploujj, tgl
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-07-08 16:01:40 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 583081    
Bug Blocks:    

Description Jan Lieskovsky 2010-07-02 12:59:41 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2598 to
the following vulnerability:

LibTIFF in Red Hat Enterprise Linux (RHEL) 3 on x86_64 platforms, as
used in tiff2rgba, attempts to process image data even when the
required compression functionality is not configured, which allows
remote attackers to cause a denial of service via a crafted TIFF
image, related to "downsampled OJPEG input."

References (in MITRE CVE description):
  [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2598
  [2] https://bugzilla.redhat.com/show_bug.cgi?id=583081

Further references:
  [3] http://bugzilla.maptools.org/show_bug.cgi?id=2207
  [4] https://bugzilla.redhat.com/show_bug.cgi?id=583081#c14

Comment 1 Jan Lieskovsky 2010-07-02 13:02:20 UTC
This issue affects the versions of the libtiff package, as shipped
with Red Hat Enterprise Linux 3, 4, and 5.


This issue does NOT affect the current versions of the libtiff
and mingw32-libtiff packages, as shipped with Fedora releases of 12
and 13 (this flaw has been already addressed in those versions).

Comment 5 Tom Lane 2010-07-02 14:00:16 UTC
Actually the problem is not at all specific to 64-bit platforms, though possibly specific manifestations of it might be.

Comment 6 Tomas Hoger 2010-07-07 09:41:20 UTC
Tom, thank you for clarification.

(In reply to comment #1)
> This issue affects the versions of the libtiff package, as shipped
> with Red Hat Enterprise Linux 3, 4, and 5.

Hence this needs to be correct to: This only affected libtiff in Red Hat Enterprise Linux 3.  libtiff versions in Red Hat Enterprise Linux 4 and later are based on upstream version that stops reading image that does not have compression method configured.

Comment 7 errata-xmlrpc 2010-07-08 15:47:09 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 3

Via RHSA-2010:0520 https://rhn.redhat.com/errata/RHSA-2010-0520.html