Date: 27 August 2008
References: ESB-2008.0840 ESB-2008.0876 ESB-2008.1014 ESB-2008.1033 ESB-2008.1049 ESB-2009.1133
Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2008.0830 -- [UNIX/Linux][Debian]
New tiff packages fix arbitrary code execution
27 August 2008
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: tiff
Publisher: Debian
Operating System: Debian GNU/Linux 4.0
UNIX variants (UNIX, Linux, OSX)
Impact: Execute Arbitrary Code/Commands
Access: Remote/Unauthenticated
CVE Names: CVE-2008-2327
Original Bulletin: http://www.debian.org/security/2008/dsa-1632
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - ------------------------------------------------------------------------
Debian Security Advisory DSA-1632-1 security@debian.org
http://www.debian.org/security/ Thijs Kinkhorst
August 26, 2008 http://www.debian.org/security/faq
- - ------------------------------------------------------------------------
Package : tiff
Vulnerability : buffer underflow
Problem type : local (remote)
Debian-specific: no
CVE Id(s) : CVE-2008-2327
Drew Yao discovered that libTIFF, a library for handling the Tagged Image
File Format, is vulnerable to a programming error allowing malformed
tiff files to lead to a crash or execution of arbitrary code.
For the stable distribution (etch), this problem has been fixed in
version 3.8.2-7+etch1.
For the testing distribution (lenny), this problem has been fixed in
version 3.8.2-10+lenny1.
The unstable distribution (sid) will be fixed soon.
We recommend that you upgrade your tiff package.
Upgrade instructions
- - --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
- - -------------------------------
Source archives:
http://security.debian.org/pool/updates/main/t/tiff/tiff_3.8.2.orig.tar.gz
Size/MD5 checksum: 1333780 e6ec4ab957ef49d5aabc38b7a376910b
http://security.debian.org/pool/updates/main/t/tiff/tiff_3.8.2-7+etch1.dsc
Size/MD5 checksum: 770 ae7a380959585d8a5034db1d488fe92d
http://security.debian.org/pool/updates/main/t/tiff/tiff_3.8.2-7+etch1.diff.gz
Size/MD5 checksum: 17476 7a2b7064067f462fe3c3e0212b7e59bf
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.8.2-7+etch1_alpha.deb
Size/MD5 checksum: 521350 e9a8d515beea436f1c5714d5d55621c4
http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.8.2-7+etch1_alpha.deb
Size/MD5 checksum: 296784 d25a95a2ee04ddf56245ec2f05f17cfb
http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0c2_3.8.2-7+etch1_alpha.deb
Size/MD5 checksum: 5148 7d6f398e75ef40e29b8c8ca5d8cc634e
http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.8.2-7+etch1_alpha.deb
Size/MD5 checksum: 11284 7aae8c6f10cf564b87f6ae0bf586b533
http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.8.2-7+etch1_alpha.deb
Size/MD5 checksum: 206802 3b78d5d7c37c68c287c1f47758df1a37
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.8.2-7+etch1_amd64.deb
Size/MD5 checksum: 503074 3546846c37da9d10d92a0bee3b9e47e5
http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.8.2-7+etch1_amd64.deb
Size/MD5 checksum: 10290 6362cc149e9d0303bf01d249f082e1c4
http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.8.2-7+etch1_amd64.deb
Size/MD5 checksum: 184662 4011f0f2cca3a6ae0753a24fe2528c00
http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.8.2-7+etch1_amd64.deb
Size/MD5 checksum: 248376 c7b256d38da9d497a677fac2f50359f5
http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0c2_3.8.2-7+etch1_amd64.deb
Size/MD5 checksum: 4926 4c30200928ab374c285135243960e347
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0c2_3.8.2-7+etch1_hppa.deb
Size/MD5 checksum: 5996 1ea4fc581e861fc4310b506ba38f7fd1
http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.8.2-7+etch1_hppa.deb
Size/MD5 checksum: 10876 7952d1695b12c4f94a441e0bbc7e0841
http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.8.2-7+etch1_hppa.deb
Size/MD5 checksum: 515280 790d82258fb2aeac736f16dc969fb83e
http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.8.2-7+etch1_hppa.deb
Size/MD5 checksum: 195268 7586a29e6dac1a5fb792569ecdaf1ad2
http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.8.2-7+etch1_hppa.deb
Size/MD5 checksum: 267664 5482149084635adb52a67f65c9ec73c7
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0c2_3.8.2-7+etch1_i386.deb
Size/MD5 checksum: 5004 8843b208a604bdf206959659b80f12f9
http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.8.2-7+etch1_i386.deb
Size/MD5 checksum: 483094 446c73c10b990c8fe254d344b74d720e
http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.8.2-7+etch1_i386.deb
Size/MD5 checksum: 9852 8345bd93b3e97de766952efb7402d11d
http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.8.2-7+etch1_i386.deb
Size/MD5 checksum: 175592 bd7a1cc32a60a78b600326c141168bd1
http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.8.2-7+etch1_i386.deb
Size/MD5 checksum: 233456 7974f2bbc21c436cd1cbd8a18c091c7e
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.8.2-7+etch1_ia64.deb
Size/MD5 checksum: 552216 fa4a4dc20e9aae562cf45d162252bcec
http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.8.2-7+etch1_ia64.deb
Size/MD5 checksum: 250698 7a15422b465b3e5a18e4a067095f06d0
http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.8.2-7+etch1_ia64.deb
Size/MD5 checksum: 13168 d7f8222f2b5045171fb06b9d672527b6
http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0c2_3.8.2-7+etch1_ia64.deb
Size/MD5 checksum: 6716 ed072e26f3798dd178c33d6b6ad4983b
http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.8.2-7+etch1_ia64.deb
Size/MD5 checksum: 326164 27b4d01afafe60fded61f4c379d4efa9
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.8.2-7+etch1_mips.deb
Size/MD5 checksum: 187416 18ba62f6a4edc236cffdff42b9b0cc63
http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.8.2-7+etch1_mips.deb
Size/MD5 checksum: 10658 5dab9237ca90f9799665626566380630
http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.8.2-7+etch1_mips.deb
Size/MD5 checksum: 500242 a178091c78f3961d62b6ff5ef00de2cd
http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.8.2-7+etch1_mips.deb
Size/MD5 checksum: 265370 e941ddaa662094b74d2f69b9c782b702
http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0c2_3.8.2-7+etch1_mips.deb
Size/MD5 checksum: 5150 c94c2621a78b8cc5879a7f1bf2e6eb5c
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0c2_3.8.2-7+etch1_mipsel.deb
Size/MD5 checksum: 5136 7819c5b07599b8181eb8fff0691eb0d5
http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.8.2-7+etch1_mipsel.deb
Size/MD5 checksum: 188706 1715b19d851ced32bb631e4eb757f7c0
http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.8.2-7+etch1_mipsel.deb
Size/MD5 checksum: 10642 a811021ca1277f6b11561e98b11b205f
http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.8.2-7+etch1_mipsel.deb
Size/MD5 checksum: 485238 e63ac232935f95b5cb7855f82d5af997
http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.8.2-7+etch1_mipsel.deb
Size/MD5 checksum: 264550 3d180d616ec03bbfa1ca2f39dd56015f
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.8.2-7+etch1_powerpc.deb
Size/MD5 checksum: 254574 2bd571a468e7c681210903adee826373
http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.8.2-7+etch1_powerpc.deb
Size/MD5 checksum: 491216 d8ce2c65e8f70e074d0b1e8cac400d9c
http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.8.2-7+etch1_powerpc.deb
Size/MD5 checksum: 11814 52071581845d3cd43b36ee5bf94dabe2
http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0c2_3.8.2-7+etch1_powerpc.deb
Size/MD5 checksum: 6698 3ce576847f1aeee554fda52f52bb9594
http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.8.2-7+etch1_powerpc.deb
Size/MD5 checksum: 203230 5922ac34b5f5d07c94908cbfb6a57113
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.8.2-7+etch1_s390.deb
Size/MD5 checksum: 10722 4c80a47c46ce6f699f0e9ee0ce72045e
http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.8.2-7+etch1_s390.deb
Size/MD5 checksum: 497566 a892a93efd34ba59116e99f282c0f4a3
http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0c2_3.8.2-7+etch1_s390.deb
Size/MD5 checksum: 5228 00cec143b258139345450da7c02afb7b
http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.8.2-7+etch1_s390.deb
Size/MD5 checksum: 248718 3296c0c882a523bf167c2f66002bea29
http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.8.2-7+etch1_s390.deb
Size/MD5 checksum: 182484 4786b0495cd7a749d89f1232dad42247
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/t/tiff/libtiff4-dev_3.8.2-7+etch1_sparc.deb
Size/MD5 checksum: 236460 49927df44f21d7c705a103c7179627e8
http://security.debian.org/pool/updates/main/t/tiff/libtiff4_3.8.2-7+etch1_sparc.deb
Size/MD5 checksum: 480938 3b2e36a5cbed1413decdd67e69e18b54
http://security.debian.org/pool/updates/main/t/tiff/libtiffxx0c2_3.8.2-7+etch1_sparc.deb
Size/MD5 checksum: 4698 3cf416179f49186c54585f469356b625
http://security.debian.org/pool/updates/main/t/tiff/libtiff-tools_3.8.2-7+etch1_sparc.deb
Size/MD5 checksum: 172524 3ec7e582b1bdcdd53dafa46af50b9ce6
http://security.debian.org/pool/updates/main/t/tiff/libtiff-opengl_3.8.2-7+etch1_sparc.deb
Size/MD5 checksum: 10236 a76e27d0c4a80ce0e7d585491ceec44e
These files will probably be moved into the stable distribution on
its next update.
- - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iQEVAwUBSLQs0Gz0hbPcukPfAQI8ggf5AUNF9Q6hKNKEUMyAJXXGe1GUomOb+UwB
5flfKpcX/u2FVByMMT8gSdSZEDrrY4UcHuaZBNM/mc03rPDN9ID68dT5e53yYTwX
XAc/6abucc0aOB2czDV/ydL4M6r2SFBSBoEq5QQLnCA5oS6is5jeJXby36cUjFGQ
2osOUs9X0O0kWaicbrehZC0UldsAVejsFmH2HETnO7P3V0qiQcg/aqqXXW277Gg/
2mhOYaYLRw5r4KmrojJm74PTn33Hkx8LLHFar+JVDX6WblH6S8WTnGx67YOs35DU
Gm+JhboEYjc82jVVlc1riSe51ur+lNWyd7kJaeGbpJ2IlzOD6gDGpg==
=+eYZ
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBSLSyCih9+71yA2DNAQLi+wP/a1amwlrIwKl6oXw3Zb5TDghqr45Jaftf
WybVo1kHOzudWGYn8W0DFyXSYbI2aEFSeszHofuO/yZqvJ6vppNxjUopgPQc+f3U
zd4tQM0tDgTffzoUCClYyNB4Gxyor+MEjMbLvoUilc/4d0Nn2FGcckD/299C7thM
UwJry8vZV74=
=HRue
-----END PGP SIGNATURE-----
|