Buffer overflow in LibTIFF - CVE-2020-19144

Vulnerability identifier: #VU65438

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-19144

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing files within the _TIFFmemcpy() funtion in "tif_unix.c". A remote attacker can create a specially crafted image file, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

LibTIFF
Ubuntu
Tanzu Greenplum for Kubernetes
VMware Tanzu Operations Manager
HPE Moonshot 1500 Chassis Manager
libtiff-opengl (Ubuntu package)
libtiffxx5 (Ubuntu package)
libtiff5 (Ubuntu package)
libtiff-tools (Ubuntu package)

Install updates from vendor's website.

Tanzu Greenplum for Kubernetes - update to 2.0.0
VMware Tanzu Operations Manager - addressed in versions 2.7.25, 2.8.16, 2.9.12, 2.10.39
HPE Moonshot 1500 Chassis Manager - update to 4.0-b43
libtiff-opengl (Ubuntu package) - addressed in versions 4.0.9-5ubuntu0.6, 4.0.9-5ubuntu0.7, 4.0.61ubuntu0.8+esm2, 4.1.0+git191117-2ubuntu0.20.04.4, 4.1.0+git191117-2ubuntu0.20.04.5, 4.3.0-6ubuntu0.1
libtiffxx5 (Ubuntu package) - addressed in versions 4.0.9-5ubuntu0.6, 4.0.9-5ubuntu0.7, 4.0.61ubuntu0.8+esm2, 4.1.0+git191117-2ubuntu0.20.04.4, 4.1.0+git191117-2ubuntu0.20.04.5, 4.3.0-6ubuntu0.1
libtiff5 (Ubuntu package) - addressed in versions 4.0.9-5ubuntu0.6, 4.0.9-5ubuntu0.7, 4.0.61ubuntu0.8+esm2, 4.1.0+git191117-2ubuntu0.20.04.4, 4.1.0+git191117-2ubuntu0.20.04.5, 4.3.0-6ubuntu0.1
libtiff-tools (Ubuntu package) - addressed in versions 4.0.9-5ubuntu0.6, 4.0.9-5ubuntu0.7, 4.0.61ubuntu0.8+esm2, 4.1.0+git191117-2ubuntu0.20.04.4, 4.1.0+git191117-2ubuntu0.20.04.5, 4.3.0-6ubuntu0.1

• http://bugzilla.maptools.org/show_bug.cgi?id=2852
• https://gitlab.com/libtiff/libtiff/-/issues/159
• https://security.netapp.com/advisory/ntap-20211004-0005/
• https://lists.debian.org/debian-lts-announce/2021/10/msg00004.html

• Ubuntu update for tiff
• Ubuntu update for tiff
• Ubuntu update for tiff
• VMware Tanzu products update for LibTIFF
• Multiple vulnerabilities in HPE Moonshot 1500 Chassis Manager