DB: 2017-07-07
3 new exploits LibTIFF - 'tif_dirwrite.c' Denial of Service LibTIFF - 'tif_jbig.c' Denial of Service LibTIFF - '_TIFFVGetField (tiffsplit)' Out-of-Bounds Read
This commit is contained in:
Offensive Security
parent
9a0992d704
commit
d3536f6bef
4 changed files with 223 additions and 0 deletions
|
|
@ -5605,6 +5605,9 @@ id,file,description,date,author,platform,type,port
|
|||
42279,platforms/freebsd_x86/dos/42279.c,"FreeBSD - 'setrlimit' Stack Clash (PoC)",2017-06-28,"Qualys Corporation",freebsd_x86,dos,0
|
||||
42285,platforms/android/dos/42285.txt,"LG MRA58K - 'ASFParser::SetMetaData' Stack Overflow",2017-06-30,"Google Security Research",android,dos,0
|
||||
42286,platforms/multiple/dos/42286.txt,"Google Chrome - Out-of-Bounds Access in RegExp Stubs",2017-06-30,"Google Security Research",multiple,dos,0
|
||||
42299,platforms/linux/dos/42299.txt,"LibTIFF - 'tif_dirwrite.c' Denial of Service",2017-07-06,"team OWL337",linux,dos,0
|
||||
42300,platforms/linux/dos/42300.txt,"LibTIFF - 'tif_jbig.c' Denial of Service",2017-07-06,"team OWL337",linux,dos,0
|
||||
42301,platforms/linux/dos/42301.txt,"LibTIFF - '_TIFFVGetField (tiffsplit)' Out-of-Bounds Read",2017-07-06,zhangtan,linux,dos,0
|
||||
3,platforms/linux/local/3.c,"Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Privilege Escalation",2003-03-30,"Wojciech Purczynski",linux,local,0
|
||||
4,platforms/solaris/local/4.c,"Sun SUNWlldap Library Hostname - Buffer Overflow",2003-04-01,Andi,solaris,local,0
|
||||
12,platforms/linux/local/12.c,"Linux Kernel < 2.4.20 - Module Loader Privilege Escalation",2003-04-14,KuRaK,linux,local,0
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
87
platforms/linux/dos/42299.txt
Executable file
87
platforms/linux/dos/42299.txt
Executable file
|
|
@ -0,0 +1,87 @@
|
|||
Source: http://bugzilla.maptools.org/show_bug.cgi?id=2712
|
||||
|
||||
Triggered by "./tiffset POC1"
|
||||
|
||||
$ ./tiffset POC1
|
||||
TIFFReadDirectory: Warning, Unknown field with tag 302 (0x12e) encountered.
|
||||
TIFFReadDirectory: Warning, Unknown field with tag 61961 (0xf209) encountered.
|
||||
poc3: AdobeDeflate compression support is not configured.
|
||||
tiffset: tif_dirwrite.c:2127: int TIFFWriteDirectoryTagCheckedLong8Array(TIFF
|
||||
*, uint32 *, TIFFDirEntry *, uint16, uint32, uint64 *): Assertion
|
||||
`tif->tif_flags&TIFF_BIGTIFF' failed.
|
||||
Aborted
|
||||
|
||||
The gdb debugging information is listed below:
|
||||
(gdb) set args POC1
|
||||
(gdb) r
|
||||
...
|
||||
(gdb) c
|
||||
Continuing.
|
||||
TIFFReadDirectory: Warning, Unknown field with tag 302 (0x12e) encountered.
|
||||
TIFFReadDirectory: Warning, Unknown field with tag 61961 (0xf209) encountered.
|
||||
poc2: AdobeDeflate compression support is not configured.
|
||||
|
||||
Breakpoint 2, TIFFWriteDirectoryTagCheckedLong8Array (tif=<optimized out>,
|
||||
ndir=<optimized out>, count=1,
|
||||
value=0x615c20, dir=<optimized out>, tag=<optimized out>) at
|
||||
tif_dirwrite.c:2127
|
||||
2127 assert(tif->tif_flags&TIFF_BIGTIFF);
|
||||
(gdb) bt
|
||||
#0 0x00007ffff746a428 in __GI_raise (sig=sig@entry=6) at
|
||||
../sysdeps/unix/sysv/linux/raise.c:54
|
||||
#1 0x00007ffff746c02a in __GI_abort () at abort.c:89
|
||||
#2 0x00007ffff7462bd7 in __assert_fail_base (fmt=<optimized out>,
|
||||
assertion=assertion@entry=0x7ffff7baf949 "tif->tif_flags&TIFF_BIGTIFF",
|
||||
file=file@entry=0x7ffff7baf5c0 "tif_dirwrite.c", line=line@entry=2127,
|
||||
function=function@entry=0x7ffff7baf8e2 "int
|
||||
TIFFWriteDirectoryTagCheckedLong8Array(TIFF *, uint32 *, TIFFDirEntry *,
|
||||
uint16, uint32, uint64 *)") at assert.c:92
|
||||
#3 0x00007ffff7462c82 in __GI___assert_fail (assertion=0x7ffff7baf949
|
||||
"tif->tif_flags&TIFF_BIGTIFF",
|
||||
file=0x7ffff7baf5c0 "tif_dirwrite.c", line=2127,
|
||||
function=0x7ffff7baf8e2 "int TIFFWriteDirectoryTagCheckedLong8Array(TIFF *,
|
||||
uint32 *, TIFFDirEntry *, uint16, uint32, uint64 *)") at assert.c:101
|
||||
#4 0x00007ffff7b4e9cb in TIFFWriteDirectoryTagCheckedLong8Array (tif=0x615010,
|
||||
ndir=<optimized out>, count=1,
|
||||
value=0x615c20, dir=<optimized out>, tag=<optimized out>) at
|
||||
tif_dirwrite.c:2127
|
||||
#5 TIFFWriteDirectoryTagLong8Array (count=1, value=0x615c20, tif=<optimized
|
||||
out>, ndir=<optimized out>,
|
||||
dir=<optimized out>, tag=<optimized out>) at tif_dirwrite.c:1462
|
||||
#6 TIFFWriteDirectorySec (tif=<optimized out>, isimage=<optimized out>,
|
||||
imagedone=<optimized out>,
|
||||
pdiroff=<optimized out>) at tif_dirwrite.c:746
|
||||
#7 0x00007ffff7b4f6b5 in TIFFWriteDirectory (tif=0x615010) at
|
||||
tif_dirwrite.c:184
|
||||
#8 TIFFRewriteDirectory (tif=<optimized out>) at tif_dirwrite.c:360
|
||||
#9 0x0000000000402bc7 in main (argc=<optimized out>, argv=<optimized out>) at
|
||||
tiffset.c:344
|
||||
|
||||
Trigged in line tif_dirwrite.c:2127 at function
|
||||
TIFFWriteDirectoryTagCheckedLong8Array()
|
||||
2122 static int
|
||||
2123 TIFFWriteDirectoryTagCheckedLong8Array(TIFF* tif, uint32* ndir,
|
||||
TIFFDirEntry* dir, uint16 tag, uint32 count, uint64* value)
|
||||
2124 {
|
||||
2125 assert(count<0x20000000);
|
||||
2126 assert(sizeof(uint64)==8);
|
||||
2127 assert(tif->tif_flags&TIFF_BIGTIFF);
|
||||
2128 if (tif->tif_flags&TIFF_SWAB)
|
||||
2129 TIFFSwabArrayOfLong8(value,count);
|
||||
2130
|
||||
return(TIFFWriteDirectoryTagData(tif,ndir,dir,tag,TIFF_LONG8,count,count*8,value));
|
||||
2131 }
|
||||
|
||||
[note]: Tiffset sets the value of a TIFF header to a specified value.It will
|
||||
modify the raw POC file,so you'd better make a backup file every time you are
|
||||
going to run.
|
||||
|
||||
Credits:
|
||||
|
||||
This vulnerability is detected by team OWL337, with our custom fuzzer collAFL.
|
||||
Please contact ganshuitao@gmail.com and chaoz@tsinghua.edu.cn if you need
|
||||
more info about the team, the tool or the vulnerability.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42299.zip
|
||||
42
platforms/linux/dos/42300.txt
Executable file
42
platforms/linux/dos/42300.txt
Executable file
|
|
@ -0,0 +1,42 @@
|
|||
Source: http://bugzilla.maptools.org/show_bug.cgi?id=2706
|
||||
|
||||
Triggered by “./tiff2ps $POC” or “./tiff2pdf $POC”
|
||||
|
||||
Triggered by “./tiff2ps $POC” or “./tiff2pdf $POC”
|
||||
|
||||
The asan debug information is below:
|
||||
|
||||
$./tiff2ps $POC
|
||||
|
||||
|
||||
=================================================================
|
||||
==26627==ERROR: LeakSanitizer: detected memory leaks
|
||||
|
||||
Direct leak of 1792 byte(s) in 7 object(s) allocated from:
|
||||
#0 0x7f7c4f1a19aa in malloc
|
||||
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989aa)
|
||||
#1 0x7f7c4dca72fd (/usr/lib/x86_64-linux-gnu/libjbig.so.0+0x12fd)
|
||||
#2 0x3ea (<unknown module>)
|
||||
|
||||
Indirect leak of 170491316224 byte(s) in 223 object(s) allocated from:
|
||||
#0 0x7f7c4f1a19aa in malloc
|
||||
(/usr/lib/x86_64-linux-gnu/libasan.so.2+0x989aa)
|
||||
#1 0x7f7c4dca72fd (/usr/lib/x86_64-linux-gnu/libjbig.so.0+0x12fd)
|
||||
#2 0x3ea (<unknown module>)
|
||||
|
||||
SUMMARY: AddressSanitizer: 170491318016 byte(s) leaked in 230 allocation(s).
|
||||
|
||||
|
||||
Affected version:
|
||||
<=the Latest version (4.0.8)
|
||||
|
||||
|
||||
Credits:
|
||||
|
||||
This vulnerability is detected by team OWL337, with our custom fuzzer coll AFL.
|
||||
Please contact ganshuitao@gmail.com and chaoz@tsinghua.edu.cn if you need more
|
||||
info about the team, the tool or the vulnerability.
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42300.zip
|
||||
91
platforms/linux/dos/42301.txt
Executable file
91
platforms/linux/dos/42301.txt
Executable file
|
|
@ -0,0 +1,91 @@
|
|||
Source: http://bugzilla.maptools.org/show_bug.cgi?id=2693
|
||||
|
||||
On 4.0.7:
|
||||
|
||||
# tiffsplit $FILE
|
||||
|
||||
==2007== Invalid read of size 4
|
||||
==2007== at 0x40CD1A: _TIFFVGetField (tif_dir.c:1072)
|
||||
==2007== by 0x41B2C5: TIFFVGetField (tif_dir.c:1198)
|
||||
==2007== by 0x41B2C5: TIFFGetField (tif_dir.c:1182)
|
||||
==2007== by 0x404CCF: tiffcp (tiffsplit.c:220)
|
||||
==2007== by 0x404CCF: main (tiffsplit.c:89)
|
||||
==2007== Address 0x0 is not stack'd, malloc'd or (recently) free'd
|
||||
|
||||
------- Comment #1 From zhangtan 2017-05-15 01:20:26 -------
|
||||
|
||||
The place of Out of bound read:
|
||||
|
||||
ret_val = 0;
|
||||
for (i = 0; i < td->td_customValueCount; i++) {
|
||||
TIFFTagValue *tv = td->td_customValues + i;
|
||||
|
||||
if (tv->info->field_tag != tag)
|
||||
continue;
|
||||
|
||||
------- Comment #2 From zhangtan 2017-05-15 01:29:10 -------
|
||||
|
||||
The place of Out of bound read:
|
||||
|
||||
The 1072 line of tif_dir.c
|
||||
|
||||
1068 ret_val = 0;
|
||||
1069 for (i = 0; i < td->td_customValueCount; i++) {
|
||||
1070 TIFFTagValue *tv = td->td_customValues + i;
|
||||
1071
|
||||
1072 if (tv->info->field_tag != tag)
|
||||
1073 continue;
|
||||
|
||||
As tv increased in 1070, Out of bound read happened in 1072 when the pointer tv
|
||||
was referenced.
|
||||
|
||||
------- Comment #3 From zhangtan 2017-05-15 01:46:33 -------
|
||||
|
||||
PoC:
|
||||
|
||||
Detailed information of the bug can be reproduced using the valgrind tool:
|
||||
|
||||
# valgrind tiffsplit $File(the testcase in the attachment)
|
||||
|
||||
Error Message:
|
||||
==23520== Invalid read of size 4
|
||||
==23520== at 0x40CD1A: _TIFFVGetField (tif_dir.c:1072)
|
||||
==23520== by 0x41B2C5: TIFFVGetField (tif_dir.c:1198)
|
||||
==23520== by 0x41B2C5: TIFFGetField (tif_dir.c:1182)
|
||||
==23520== by 0x404CCF: tiffcp (tiffsplit.c:220)
|
||||
==23520== by 0x404CCF: main (tiffsplit.c:89)
|
||||
==23520== Address 0x0 is not stack'd, malloc'd or (recently) free'd
|
||||
==23520==
|
||||
==23520==
|
||||
==23520== Process terminating with default action of signal 11 (SIGSEGV)
|
||||
==23520== Access not within mapped region at address 0x0
|
||||
==23520== at 0x40CD1A: _TIFFVGetField (tif_dir.c:1072)
|
||||
==23520== by 0x41B2C5: TIFFVGetField (tif_dir.c:1198)
|
||||
==23520== by 0x41B2C5: TIFFGetField (tif_dir.c:1182)
|
||||
==23520== by 0x404CCF: tiffcp (tiffsplit.c:220)
|
||||
==23520== by 0x404CCF: main (tiffsplit.c:89)
|
||||
==23520== If you believe this happened as a result of a stack
|
||||
==23520== overflow in your program's main thread (unlikely but
|
||||
==23520== possible), you can try to increase the size of the
|
||||
==23520== main thread stack using the --main-stacksize= flag.
|
||||
==23520== The main thread stack size used in this run was 8388608.
|
||||
==23520==
|
||||
==23520== HEAP SUMMARY:
|
||||
==23520== in use at exit: 17,821 bytes in 42 blocks
|
||||
==23520== total heap usage: 96 allocs, 54 frees, 59,223 bytes allocated
|
||||
==23520==
|
||||
==23520== LEAK SUMMARY:
|
||||
==23520== definitely lost: 0 bytes in 0 blocks
|
||||
==23520== indirectly lost: 0 bytes in 0 blocks
|
||||
==23520== possibly lost: 0 bytes in 0 blocks
|
||||
==23520== still reachable: 17,821 bytes in 42 blocks
|
||||
==23520== suppressed: 0 bytes in 0 blocks
|
||||
==23520== Rerun with --leak-check=full to see details of leaked memory
|
||||
==23520==
|
||||
==23520== For counts of detected and suppressed errors, rerun with: -v
|
||||
==23520== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
|
||||
Segmentation fault
|
||||
|
||||
|
||||
Proof of Concept:
|
||||
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/42301.zip
|
||||
Loading…
Add table
Reference in a new issue