Libtiff

Libtiff
Developer(s) Sam Leffler,
Silicon Graphics
Initial release 1988 (1988)
Stable release 4.0.6 / September 12, 2015 (2015-09-12)
Development status Active
Written in C
License BSD-like licence
Website http://www.remotesensing.org/libtiff/

Libtiff is a library for reading and writing Tagged Image File Format (abbreviated TIFF) files. The set also contains command line tools for processing TIFFs. It is distributed in source code and can be found as binary builds for all kinds of platforms. The libtiff software was written by Sam Leffler while working for Silicon Graphics.

Features

Support for BigTIFF files larger than 4 GiB (4,294,967,296 bytes) was included for Libtiff 4.0.

Exploits

A TIFF file is composed of small descriptor blocks containing offsets into the file which point to a variety of data types. Incorrect offset values can cause programs to attempt to read erroneous portions of the file or attempt to read past the physical end of file. Improperly encoded packet or line lengths within the file can cause rendering programs which lack appropriate boundary checks to overflow their internal buffers.

Multiple buffer overflows have been found in Libtiff.[1][2][3] Some of these have also been used to execute unsigned code on the PlayStation Portable,[4] as well as run third-party applications on the iPhone and iPod Touch firmware.[5]

Website hijacking

The original libtiff website (libtiff.org) has been hijacked.[6] While it now contains a mirror of the real site for current development, the libtiff.org site has not been updated since version 3.6.1. Because of this, much of the information contained therein is incorrect, including the current version number, authors, mailing list address, and the CVS information.

References

  1. ↑ libTIFF BitsPerSample Tag Buffer Overflow Vulnerability Release Date:2005-05-11 - Secunia Advisories
  2. ↑ Stack-based buffer overflow in libTIFF before 3.7.2 allows remote attackers to execute arbitrary code via a TIFF file with a malformed BitsPerSample tag. - CVE - CVE-2005-1544 (under review) Assigned (20050514)
  3. ↑ libTIFF Multiple Vulnerabilities Release Date: 2006-08-02 - Secunia Advisories
  4. ↑ Sony PSP TIFF Image Viewing Code Execution Vulnerability Release Date: 2006-08-31 - Secunia Advisories
  5. ↑ http://www.macnn.com/articles/07/10/17/iphone.tiff.exploit.detail/
  6. ↑ https://trac.osgeo.org/grass/ticket/768

External links

This article is issued from Wikipedia - version of the Thursday, October 08, 2015. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.