PT-2006-7530 · Libtiff+1 · Libtiff+1

Tavis Ormandy · Published 1970-01-01 · Updated 2017-10-11 · CVE-2006-3462

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions libtiff versions prior to 3.8.2

Description The issue is related to a heap-based buffer overflow in the NeXT RLE decoder in the TIFF library. This might allow attackers to execute arbitrary code via unknown vectors involving decoding large RLE images. Multiple vulnerabilities in the libtiff package can lead to disruption of availability of protected information and can be exploited remotely.

Recommendations For libtiff versions prior to 3.8.2, update to version 3.8.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the TIFF library until a patch is available. Avoid using the NeXT RLE decoder in the TIFF library until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-00793

BDU:2015-04888

BDU:2015-04889

BDU:2015-04890

BDU:2015-04891

BDU:2015-04892

BDU:2015-04893

BDU:2015-04894

BDU:2015-06213

BDU:2015-06214

BDU:2015-06217

BDU:2015-06218

BDU:2015-09521

CVE-2006-3462

DSA-1137-1

RHSA-2006:0603

RHSA-2006:0648

RHSA-2006_0603

Affected Products

Red Hat

Libtiff

References · 87

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/apple_ios/email/mobilemail_libtiff.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/apple_ios/browser/safari_libtiff.rb · Exploit
• https://bdu.fstec.ru/vul/2015-04890 · Security Note
• http://vupen.com/english/advisories/2007/4034 · Vendor Advisory
• http://secunia.com/advisories/21334 · Vendor Advisory
• http://secunia.com/advisories/21598 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-103160-1 · Vendor Advisory
• http://vupen.com/english/advisories/2006/3105 · Vendor Advisory
• http://secunia.com/advisories/21304 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3461 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3459 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2006-3462 · Security Note
• http://secunia.com/advisories/27222 · Vendor Advisory
• http://secunia.com/advisories/21290 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04894 · Security Note