#VU29281 Buffer underflow in LibTIFF - CVE-2008-2327

Vulnerability identifier: #VU29281

Vulnerability risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2008-2327

CWE-ID: CWE-119

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
LibTIFF
Universal components / Libraries / Libraries used by multiple products

Vendor: LibTIFF

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the LZWDecode(),  LZWDecodeCompat(), and  LZWDecodeVector() functions in tif_lzw.c in the LZW decoder in LibTIFF when processing TIFF files. A remote attacker can create a specially crafted TIFF image, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

LibTIFF: 3.8.0 - 3.8.2

---

External links
https://bugs.gentoo.org/show_bug.cgi?id=234080
https://lists.apple.com/archives/security-announce//2008/Nov/msg00001.html
https://lists.apple.com/archives/security-announce//2008/Sep/msg00005.html
https://lists.apple.com/archives/security-announce/2008/Nov/msg00002.html
https://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html
https://security.gentoo.org/glsa/glsa-200809-07.xml
https://security-tracker.debian.net/tracker/CVE-2008-2327
https://security-tracker.debian.net/tracker/DSA-1632-1
https://security-tracker.debian.net/tracker/DTSA-160-1
https://sunsolve.sun.com/search/document.do?assetkey=1-26-265030-1
https://support.apple.com/kb/HT3276
https://support.apple.com/kb/HT3298
https://support.apple.com/kb/HT3318
https://www.debian.org/security/2008/dsa-1632
https://www.mandriva.com/security/advisories?name=MDVSA-2008:184
https://www.redhat.com/support/errata/RHSA-2008-0847.html
https://www.redhat.com/support/errata/RHSA-2008-0848.html
https://www.redhat.com/support/errata/RHSA-2008-0863.html
https://www.securityfocus.com/archive/1/496033/100/0/threaded
https://www.securityfocus.com/archive/1/497962/100/0/threaded
https://www.securityfocus.com/bid/30832
https://www.securitytracker.com/id?1020750
https://www.ubuntu.com/usn/usn-639-1
https://www.us-cert.gov/cas/techalerts/TA08-260A.html
https://www.vmware.com/security/advisories/VMSA-2008-0017.html
https://www.vupen.com/english/advisories/2008/2438
https://www.vupen.com/english/advisories/2008/2584
https://www.vupen.com/english/advisories/2008/2776
https://www.vupen.com/english/advisories/2008/2971
https://www.vupen.com/english/advisories/2008/3107
https://www.vupen.com/english/advisories/2008/3232
https://www.vupen.com/english/advisories/2009/2143
https://bugzilla.redhat.com/show_bug.cgi?id=458674
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11489
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5514
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00102.html
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00121.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.