Remote code execution in LibTIFF - CVE-2016-5652

Vulnerability identifier: #VU1066

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-5652

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated user to execute arbitrary code execution om the target system.
The weakness exists due to improper handling of compressed, TIFF images. By convincing the victim to open a file with specially crafted TIFF images, attackers can trigger a heap-buffer overflow and execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution.

LibTIFF
tiff (Alpine package)
libtiff (Red Hat package)
libtiff
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Server for ARM
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Slackware Linux

Securitylab is temporaly unaware of the patches resolving the vulnerability.

tiff (Alpine package) - update to 4.0.7-r0
libtiff (Red Hat package) - addressed in versions 3.9.4-21.el6_8, 4.0.3-27.el7_3
libtiff - update to 4.0.7

• http://blog.talosintel.com/2016/10/LibTIFF-Code-Execution.html

• Remote code execution in LibTIFF LibTIFF
• Remote code execution in tiff (Alpine package)
• Slackware Linux update for libtiff
• Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7 update for libtiff