Detections
Analytics

Amazon Linux AMI : libtiff (ALAS-2014-365)

medium Nessus Plugin ID 78308

Language:

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a denial of service (crash) or possible execute arbitrary code via a crafted TIFF image.

The LZW decompressor in the gif2tiff tool in libtiff 4.0.3 and earlier allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a crafted GIF image.

Heap-based buffer overflow in the readgifimage function in the gif2tiff tool in libtiff 4.0.3 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted height and width values in a GIF image.

Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2) GIF raster image to tools/gif2tiff.c or (3) a long filename for a TIFF image to tools/rgb2ycbcr.c. NOTE: vectors 1 and 3 are disputed by Red Hat, which states that the input cannot exceed the allocated buffer size.

Solution

Run 'yum update libtiff' to update your system.

See Also

https://alas.aws.amazon.com/ALAS-2014-365.html

Plugin Details

Severity: Medium

ID: 78308

File Name: ala_ALAS-2014-365.nasl

Version: 1.3

Type: local

Agent: unix

Published: 10/12/2014

Updated: 4/18/2018

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:libtiff, p-cpe:/a:amazon:linux:libtiff-debuginfo, p-cpe:/a:amazon:linux:libtiff-devel, p-cpe:/a:amazon:linux:libtiff-static, cpe:/o:amazon:linux

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Patch Publication Date: 6/26/2014

Reference Information

CVE: CVE-2013-4231, CVE-2013-4232, CVE-2013-4243, CVE-2013-4244

ALAS: 2014-365