CVE-2010-2067: Buffer Overflow
iDefense reported to us a libtiff flaw discovered by Dan Rosenberg. Quoting description from iDefense advisory draft:
Remote exploitation of a stack buffer overflow vulnerability in version 3.9.2 of LibTIFF, as included in various vendors' operating system distributions, could allow an attacker to execute arbitrary code with the privileges of the current user.
...
This vulnerability is due to insufficient bounds checking when copying data into a stack allocated buffer. During the processing of a certain EXIF tag a fixed sized stack buffer is used as a destination location for a memory copy. This memory copy can cause the bounds of a stack buffer to be overflown and this condition may lead to arbitrary code execution.
Other sources
Stack-based buffer overflow in the TIFFFetchSubjectDistance function in tifdirread.c in LibTIFF before 3.9.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long EXIF SubjectDistance field in a TIFF file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2067?
CVE-2010-2067 has a high severity level due to its potential for remote exploitation via stack buffer overflow.
How do I fix CVE-2010-2067?
To fix CVE-2010-2067, upgrade to LibTIFF version 3.9.4 or later.
Who is affected by CVE-2010-2067?
CVE-2010-2067 affects users of LibTIFF versions up to 3.9.2 on various operating systems, including specific versions of Ubuntu Linux.
What are the potential consequences of CVE-2010-2067?
Exploitation of CVE-2010-2067 could allow attackers to execute arbitrary code remotely on affected systems.
Is CVE-2010-2067 a type of buffer overflow vulnerability?
Yes, CVE-2010-2067 is specifically a stack buffer overflow vulnerability.