tiff on Go Tile Data reader.go allocation of resources

Summaryinfo

A vulnerability classified as problematic has been found in tiff on Go. This affects an unknown function of the file reader.go of the component Tile Data Handler. This manipulation causes allocation of resources. The identification of this vulnerability is CVE-2023-29408. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in tiff on Go (version now known). It has been declared as problematic. Affected by this vulnerability is some unknown processing of the file reader.go of the component Tile Data Handler. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. The summary by CVE is:

The TIFF decoder does not place a limit on the size of compressed tile data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height, and encoded size) to make the decoder decode large amounts of compressed data, consuming excessive memory and CPU.

The weakness was shared 08/02/2023. This vulnerability is known as CVE-2023-29408 since 04/05/2023. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 226426 (Linux Distros Unpatched Vulnerability : CVE-2023-29408), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the databases at Tenable (226426) and CERT Bund (WID-SEC-2023-1938). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• SUSE Manager
• Golang Go
• RESF Rocky Linux
• Red Hat OpenShift
• IBM App Connect Enterprise
• Splunk Splunk Enterprise

Productinfo

Name

• tiff

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion