Note: This is an archival copy of Security Sun Alert 265030 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1020798.1.
Solaris 8 Operating System
Solaris 9 Operating System
Solaris 10 Operating System
Date of Workaround Release
Multiple security vulnerabilities in libtiff(3) handling of CODE_CLEAR code:
Multiple security vulnerabilities have been found in libtiff(3), a library for reading and writing Tag Image File Format (TIFF) files. These vulnerabilities may allow a local or remote unprivileged user to create a carefully crafted LZW-encoded TIFF file that may cause an application linked with libtiff(3) to crash or possibly execute arbitrary code.
These issues are also described in the following document:
CVE-2008-2327 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2327
2. Contributing Factors
These issues can occur in the following releases:
Note 2: This issue can only occur on systems with SUNWTiff installed. To determine if SUNWTiff is installed, execute the following command:
$ pkginfo SUNWTiffNote 3: OpenSolaris distributions may include additional bug fixes above and beyond the build from which it was derived. To determine the base build of OpenSolaris, the following command can be used:
$ uname -vNote 4: Solaris 8 entered EOSL Phase 2 on 1 April 2009. Entitlement to patches developed on or after 1 April 2009 requires the purchase of the [Solaris 8 Vintage Patch Service]. See note in section 5 for more details.
Viewing a maliciously crafted TIFF image may lead to an unexpected application termination. There are no predictable symptoms that would indicate these issues have been exploited to execute arbitrary code.
To work around the described issues, do not load TIFF images from untrusted sources.
These issues are addressed in the following releases:
Note: The READMEs of Solaris 8 patches developed on or after 1 April 2009 are available to all customers however Solaris 8 entered EOSL Phase 2 on April 1, 2009 and thus entitlement for these patches, including those that fix security vulnerabilities, requires the purchase of the Solaris 8 Vintage Patch Service. More information about the Solaris 8 Vintage Patch Service is available at:
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
12-Aug-2009: Updated the Contributing Factors section.
This solution has no attachment