LibTiff Mailing List
TIFF and LibTiff Mailing List Archive
August 2008
Previous Thread
Next Thread
Previous by Thread
Next by Thread
Previous by Date
Next by Date
Contact
The TIFF Mailing List Homepage
This list is run by Frank Warmerdam
Archive maintained by AWare Systems
Thread
2008.09.01 06:29 "Re: Some security fixes from RHEL", by Rogier Wolff
On Sun, Aug 31, 2008 at 05:17:07PM -0500, Bob Friesenhahn wrote:
> While libtiff is for the large part high quality software, the
> sophistication of the black-hats (and white-hats too) should not be
> underestimated. Earlier this year I discovered a jackpot of malicious
> files (collected by a white-hat) and spent a few weeks fixing
> GraphicsMagick so that it was resistent to them. The level of genius
> represented by these files is pretty astounding.
The power of "randomness" is also big.
If I'm guessing the current state of the software correctly, a lot can
already be gained by having a "test-file-generator".
The test-file-generator will take an example tiff (preferably from a
pool with different features turned on in the headers), and then flip
a small percentage of bytes.
The test-setup will then request a test-file from the generator, and
then for example try to convert it. (e.g.
t=0
while true ; do
generate-test-file 150 sourcetiff.tiff > test$t.tif
tifftopnm test$t.tif > test$t.ppm
t=`expr $t + 1`
done
)
Of course you won't find a working exploit this way. What you will
find is that the program tifftopnm crashes occasionally. If you trace
the crash, you will likely (say about 50%) find a bug that can be
turned into a hack by the blackhats.
Roger.
--
** R.E.Wolff@BitWizard.nl ** http://www.BitWizard.nl/ ** +31-15-2600998 **
** Delftechpark 26 2628 XH Delft, The Netherlands. KVK: 27239233 **
*-- BitWizard writes Linux device drivers for any device you may have! --*
Q: It doesn't work. A: Look buddy, doesn't work is an ambiguous statement.
Does it sit on the couch all day? Is it unemployed? Please be specific!
Define 'it' and what it isn't doing. --------- Adapted from lxrbot FAQ