Amazon Linux AMI update for libtiff



Published: 2014-06-26
Risk Medium
Patch available YES
Number of vulnerabilities 4
CVE-ID CVE-2013-4231
CVE-2013-4232
CVE-2013-4243
CVE-2013-4244
CWE-ID CWE-20
CWE-94
CWE-119
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		Amazon Linux AMI
Operating systems & Components / Operating system

Vendor Amazon Web Services

Security Bulletin

This security bulletin contains information about 4 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU32624

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2013-4231

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows remote attackers to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2) GIF raster image to tools/gif2tiff.c or (3) a long filename for a TIFF image to tools/rgb2ycbcr.c.

Mitigation

Update the affected packages:

i686:
    libtiff-devel-4.0.3-15.19.amzn1.i686
    libtiff-4.0.3-15.19.amzn1.i686
    libtiff-static-4.0.3-15.19.amzn1.i686
    libtiff-debuginfo-4.0.3-15.19.amzn1.i686

src:
    libtiff-4.0.3-15.19.amzn1.src

x86_64:
    libtiff-devel-4.0.3-15.19.amzn1.x86_64
    libtiff-static-4.0.3-15.19.amzn1.x86_64
    libtiff-4.0.3-15.19.amzn1.x86_64
    libtiff-debuginfo-4.0.3-15.19.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2014-365.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Code Injection

EUVDB-ID: #VU31838

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:C]

CVE-ID: CVE-2013-4232

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in a crafted TIFF image. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    libtiff-devel-4.0.3-15.19.amzn1.i686
    libtiff-4.0.3-15.19.amzn1.i686
    libtiff-static-4.0.3-15.19.amzn1.i686
    libtiff-debuginfo-4.0.3-15.19.amzn1.i686

src:
    libtiff-4.0.3-15.19.amzn1.src

x86_64:
    libtiff-devel-4.0.3-15.19.amzn1.x86_64
    libtiff-static-4.0.3-15.19.amzn1.x86_64
    libtiff-4.0.3-15.19.amzn1.x86_64
    libtiff-debuginfo-4.0.3-15.19.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2014-365.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Code Injection

EUVDB-ID: #VU31835

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:C]

CVE-ID: CVE-2013-4243

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in a crafted height and width values in a GIF image. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update the affected packages:

i686:
    libtiff-devel-4.0.3-15.19.amzn1.i686
    libtiff-4.0.3-15.19.amzn1.i686
    libtiff-static-4.0.3-15.19.amzn1.i686
    libtiff-debuginfo-4.0.3-15.19.amzn1.i686

src:
    libtiff-4.0.3-15.19.amzn1.src

x86_64:
    libtiff-devel-4.0.3-15.19.amzn1.x86_64
    libtiff-static-4.0.3-15.19.amzn1.x86_64
    libtiff-4.0.3-15.19.amzn1.x86_64
    libtiff-debuginfo-4.0.3-15.19.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2014-365.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU32525

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2013-4244

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted GIF image.

Mitigation

Update the affected packages:

i686:
    libtiff-devel-4.0.3-15.19.amzn1.i686
    libtiff-4.0.3-15.19.amzn1.i686
    libtiff-static-4.0.3-15.19.amzn1.i686
    libtiff-debuginfo-4.0.3-15.19.amzn1.i686

src:
    libtiff-4.0.3-15.19.amzn1.src

x86_64:
    libtiff-devel-4.0.3-15.19.amzn1.x86_64
    libtiff-static-4.0.3-15.19.amzn1.x86_64
    libtiff-4.0.3-15.19.amzn1.x86_64
    libtiff-debuginfo-4.0.3-15.19.amzn1.x86_64

Vulnerable software versions

Amazon Linux AMI: All versions

CPE2.3 External links

http://alas.aws.amazon.com/ALAS-2014-365.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###