CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
8.0 | $0-$5k | 0.00 |
A vulnerability classified as critical was found in LibTIFF 4.0.5 (Image Processing Software). Affected by this vulnerability is the function ZIPEncode
of the file tif_zip.c. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:
The ZIPEncode function in tif_zip.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c zip" option is used, allows remote attackers to cause a denial of service (buffer over-read) via a crafted BMP image.
The weakness was presented 04/07/2016 as confirmed mailinglist post (oss-sec). It is possible to read the advisory at seclists.org. This vulnerability is known as CVE-2016-3620 since 03/21/2016. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.
The vulnerability scanner Nessus provides a plugin with the ID 94474 (Debian DLA-693-2 : tiff regression update), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Debian Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 171720 (SUSE Enterprise Linux Security Update for tiff (SUSE-SU-2018:3879-1)).
Upgrading to version 4.0.6 eliminates this vulnerability. A possible mitigation has been published 11 months after the disclosure of the vulnerability.
The vulnerability is also documented in the databases at X-Force (112048) and Tenable (94474). See 81884, 81886, 92306 and 92310 for similar entries.
Product
Type
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 8.7VulDB Meta Temp Score: 8.0
VulDB Base Score: 9.8
VulDB Temp Score: 8.5
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 7.5
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Out-of-boundsCWE: CWE-125 / CWE-119
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Status: Unproven
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Nessus ID: 94474
Nessus Name: Debian DLA-693-2 : tiff regression update
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍
OpenVAS ID: 64341
OpenVAS Name: Debian LTS Advisory ([SECURITY] [DLA 693-2] tiff regression update)
OpenVAS File: 🔍
OpenVAS Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Upgrade: LibTIFF 4.0.6
Timeline
03/21/2016 🔍04/07/2016 🔍
04/11/2016 🔍
10/03/2016 🔍
11/02/2016 🔍
02/06/2017 🔍
07/13/2022 🔍
Sources
Product: libtiff.orgAdvisory: seclists.org
Status: Confirmed
CVE: CVE-2016-3620 (🔍)
X-Force: 112048 - LibTIFF ZIPEncode denial of service
SecurityTracker: 1035508
SecurityFocus: 72326
See also: 🔍
Entry
Created: 04/11/2016 10:07Updated: 07/13/2022 08:49
Changes: 04/11/2016 10:07 (60), 09/30/2018 09:16 (20), 07/13/2022 08:49 (4)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.