2008.08.29 22:53 "[Tiff] Some security fixes from RHEL", by Even Rouault

2008.09.01 06:29 "Re: [Tiff] Some security fixes from RHEL", by Rogier Wolff

On Sun, Aug 31, 2008 at 05:17:07PM -0500, Bob Friesenhahn wrote:

While libtiff is for the large part high quality software, the sophistication of the black-hats (and white-hats too) should not be underestimated. Earlier this year I discovered a jackpot of malicious files (collected by a white-hat) and spent a few weeks fixing GraphicsMagick so that it was resistent to them. The level of genius represented by these files is pretty astounding.

The power of "randomness" is also big.

If I'm guessing the current state of the software correctly, a lot can already be gained by having a "test-file-generator".

The test-file-generator will take an example tiff (preferably from a pool with different features turned on in the headers), and then flip a small percentage of bytes.

The test-setup will then request a test-file from the generator, and then for example try to convert it. (e.g.

        t=0
        while true ; do
                generate-test-file 150 sourcetiff.tiff > test$t.tif
                tifftopnm test$t.tif > test$t.ppm
                t=`expr $t + 1`
        done
)

Of course you won't find a working exploit this way. What you will find is that the program tifftopnm crashes occasionally. If you trace the crash, you will likely (say about 50%) find a bug that can be turned into a hack by the blackhats.

        Roger.

--

** R.E.Wolff@BitWizard.nl ** http://www.BitWizard.nl/ ** +31-15-2600998 **
**    Delftechpark 26 2628 XH  Delft, The Netherlands. KVK: 27239233    **

*-- BitWizard writes Linux device drivers for any device you may have! --*
Q: It doesn't work. A: Look buddy, doesn't work is an ambiguous statement.
Does it sit on the couch all day? Is it unemployed? Please be specific!
Define 'it' and what it isn't doing. --------- Adapted from lxrbot FAQ