An Out-of-bounds read flaw followed by a crash was found in the bmp2tiff utility (A utility used to create a TIFF file from a Microsoft Windows Device Independent Bitmap image file) shipped with libtiff. A remote attacker could provide a specially-crafted BMP (Bitmap Image) file that, when processed by bmp2tiff, would cause bmp2tiff to crash. Upstream bug: http://bugzilla.maptools.org/show_bug.cgi?id=2494
Patch ===== https://lists.debian.org/debian-release/2014/12/msg01782.html
Analysis ======== According to the file format specification of BMP * +---------------------+ * | BMPFileHeader | * +---------------------+ * | BMPInfoHeader | * +---------------------+ * | BMPColorEntry array | * +---------------------+ * | Colour-index array | * +---------------------+ in the following code of bmp2tiff.c struct { ... int32 iWidth; /* Image width */ int32 iHeight; /* Image height. If positive, image has bottom * left origin, if negative --- top left. */ ... } BMPInfoHeader; ... if (bmp_type == BMPT_WIN4 || bmp_type == BMPT_WIN5 || bmp_type == BMPT_OS22) { read(fd, &info_hdr.iWidth, 4); ... #ifdef WORDS_BIGENDIAN TIFFSwabLong((uint32*) &info_hdr.iWidth); While reading the iWidth from BMPInfoHeader of malicious file, it does not check for the negative value of the iWidth in the following code. According to the file format specification of bmp iWidth should not be having negative value in it. width = info_hdr.iWidth; Failing to sanitize the iWidth value initially and passing it to variable 'width' which is later used to encode or decode packedbits causes Out-of-bounds read flaw which leads to crash. In the libtiff only bmp2tiff seems to be having this flaw, so crash would occur only if bmp2tiff is being used by any application opening malicious file. Impact of this flaw is low and it is bit complex to create such file.
Statement: Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw in libtiff.
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2016:1547 https://rhn.redhat.com/errata/RHSA-2016-1547.html
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2016:1546 https://rhn.redhat.com/errata/RHSA-2016-1546.html