^{CVE-2020-19131:}Buffer Overflow in LibTiff v4.0.10 in invertImage() function of tiffcrop component allows denial of service attacks.

Overview

LibTiff is a widely used library for reading and writing TIFF (Tagged Image File Format) files. The vulnerability exists in the invertImage() function within the tiffcrop utility, which is used for cropping and processing TIFF images. When processing certain malformed TIFF files, the function fails to properly validate buffer boundaries, resulting in a heap buffer overflow. This can be exploited by attackers to cause the application to crash, resulting in a denial of service condition. In some scenarios, this vulnerability could potentially lead to arbitrary code execution, though this has not been confirmed.

Remediation

Organizations and users should implement the following remediation steps:

1. Update LibTiff to a patched version that addresses this vulnerability. Debian has released security updates through DLA 2777-1.

2. If immediate updating is not possible, consider implementing the following mitigations:

   • Avoid processing untrusted TIFF files with the affected tiffcrop utility
   • Implement input validation to filter potentially malicious TIFF files before processing
   • Consider running LibTiff applications in a sandboxed environment to limit the impact of potential exploitation

3. Monitor security bulletins from your operating system vendor for patches addressing this vulnerability.

4. Review the patch details in the bugzilla entry (http://bugzilla.maptools.org/show_bug.cgi?id=2831) to understand the fix implementation if you need to apply custom patches.

References

1. TopSec Blog Analysis (Chinese): http://blog.topsec.com.cn/%E5%A4%A9%E8%9E%8D%E4%BF%A1%E5%85%B3%E4%BA%8Elibtiff%E4%B8%ADinvertimage%E5%87%BD%E6%95%B0%E5%A0%86%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E7%9A%84%E5%88%86%E6%9E%90/

2. MapTools Bugzilla Entry: http://bugzilla.maptools.org/show_bug.cgi?id=2831

3. Debian LTS Security Advisory: https://lists.debian.org/debian-lts-announce/2021/10/msg00004.html [SECURITY] [DLA 2777-1] tiff security update

4. CWE-787: Out-of-bounds Write: https://cwe.mitre.org/data/definitions/787.html