Heap-based buffer over-read in tiff (Alpine package)

1) Heap-based buffer over-read

EUVDB-ID: #VU12422

Risk: Low

CVSSv3.1: 2.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:U]

CVE-ID: CVE-2018-10779

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a local attacker to cause DoS condition on the target system.

The weakness exists in the TIFFWriteScanline function in the tif_write.csource code file due to insufficient validation of user-supplied input. A local attacker can use the .bmp2tiff command to execute a specially crafted file, trigger heap-based buffer over-read and cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

tiff (Alpine package): 4.0.9-r5

External links

http://git.alpinelinux.org/aports/commit/?id=66daf3a92a46dc7cbe21409546f897884ebe8649
http://git.alpinelinux.org/aports/commit/?id=86cc76c18b9cc2239444f1ad05dfc7feb943b569
http://git.alpinelinux.org/aports/commit/?id=949010814f11ac10dd7a4b0ccf70090b10aa29bd
http://git.alpinelinux.org/aports/commit/?id=9f0242b867730fa2a8b0a7957c1d101574f31df5
http://git.alpinelinux.org/aports/commit/?id=fb2c4a5aa0c36030c950f7885b60c306268666c8

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.