Remote code execution in LibTIFF LibTIFF



Published: 2016-10-26
Risk High
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2016-5652
CWE-ID CWE-122
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		LibTIFF
Universal components / Libraries / Libraries used by multiple products

Vendor LibTIFF

Security Bulletin

This security bulletin contains one high risk vulnerability.

1) Remote code execution

EUVDB-ID: #VU1066

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-5652

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated user to execute arbitrary code execution om the target system.
The weakness exists due to improper handling of compressed, TIFF images. By convincing the victim to open a file with specially crafted TIFF images, attackers can trigger a heap-buffer overflow and execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Securitylab is temporaly unaware of the patches resolving the vulnerability.

Vulnerable software versions

LibTIFF: 4.0.6

CPE2.3 External links

http://blog.talosintel.com/2016/10/LibTIFF-Code-Execution.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###