UnixWare 7.1.4 : libtiff Multiple vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SCO Security Advisory
Subject: UnixWare 7.1.4 : libtiff Multiple vulnerabilities
Advisory number: SCOSA-2005.19
Issue date: 2005 April 07
Cross reference: sr892971 fz531015 erg712790 CAN-2004-0803 CAN-2004-0804
CAN-2004-0886 CAN-2004-0929 CAN-2004-1183 CAN-2004-1308
______________________________________________________________________________
1. Problem Description
Updated libtiff fixes several vulnerabilities:
Multiple vulnerabilities in the RLE (run length encoding)
decoders for libtiff 3.6.1 and earlier, related to buffer
overflows and integer overflows, allow remote attackers to
execute arbitrary code via TIFF files.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned th e name CAN-2004-0803 to this issue.
Vulnerability in in tif_dirread.c for libtiff allows remote
attackers to cause a denial of service (application crash)
via a TIFF image that causes a divide-by-zero error when
the number of row bytes is zero.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2004-0804 to this issue.
Multiple integer overflows in libtiff 3.6.1 and earlier allow
remote attackers to cause a denial of service (crash or memory
corruption) via TIFF images that lead to incorrect malloc calls.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned th e name CAN-2004-0886 to this issue.
Heap-based buffer overflow in the OJPEGVSetField function
in tif_ojpeg.c for libtiff 3.6.1 and earlier, when compiled
with the OJPEG_SUPPORT (old JPEG support) option, allows
remote attackers to execute arbitrary code via a malformed
TIFF image.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned th e name CAN-2004-0929 to this issue.
Integer overflow in the tiffdump utility for libtiff 3.7.1 and
earlier allows remote attackers to cause a denial of service
(application crash) and possibly execute arbitrary code via a
crafted TIFF file.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned th e name CAN-2004-1183 to this issue.
Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c
for libtiff 3.5.7 and 3.7.0 allows remote attackers to
execute arbitrary code via a TIFF file containing a TIFF_ASCII
or TIFF_UNDEFINED directory entry with a -1 entry count,
which leads to a heap-based buffer overflow.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-1308 to this issue.
2. Vulnerable Supported Versions
System Binaries
----------------------------------------------------------------------
UnixWare 7.1.4 libtiff distribution
3. Solution
The proper solution is to install the latest packages.
4. UnixWare 7.1.4
4.1 Location of Fixed Binaries
ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.19
4.2 Verification
MD5 (tiff.image) = c9f976565559059f1ae413886a43c063
md5 is available for download from
ftp://ftp.sco.com/pub/security/tools
4.3 Installing Fixed Binaries
Upgrade the affected binaries with the following sequence:
Download tiff.image to the /var/spool/pkg directory
# pkgadd -d /var/spool/pkg/tiff.image
5. References
Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1308
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1183
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0929
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0886
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0804
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0803
SCO security resources:
http://www.sco.com/support/security/index.html
SCO security advisories via email
http://www.sco.com/support/forums/security.html
This security fix closes SCO incidents sr892971 fz531015
erg712790.
6. Disclaimer
SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers
intended to promote secure installation and use of SCO
products.
7. Acknowledgments
SCO would like to thank iDEFENSE and infamous41md[at]hotpop.com
______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (SCO/SYSV)
iD8DBQFCVZtCaqoBO7ipriERAq0NAKCJyEGo562Bx4SGIYb7DQnXycvavACfXj9H
MFkNw5rfq8K3bHt9nip2nQ0=
=cjWx
-----END PGP SIGNATURE-----