CVE-2006-2656
Description
Stack-based buffer overflow in the tiffsplit command in libtiff 3.8.2 and earlier might might allow attackers to execute arbitrary code via a long filename. NOTE: tiffsplit is not setuid. If there is not a common scenario under which tiffsplit is called with attacker-controlled command line arguments, then perhaps this issue should not be included in CVE.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
tiffsplit (libtiff 3.8.2) - Local Stack Buffer Overflow
# tiffsplit (libtiff <= 3.8.2) local stack buffer overflow PoC
tiffsplit from libtiff (http://www.remotesensing.org/libtiff/)
is vulnerable to a bss-based and stack-based overflow, but, I just
wrote the concept c0de for stack-based b0f 'cause I don't know how
to take advantage of the overwritten bss data (after the overflow,
that data is overwritten again correctly by a program' function).
.bss section is in higher addresses than .dtors section, so, we
can't hijack .dtors to....
PoC: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/1831.tar.gz (05262006-tiffspl33t.tar.gz)
nitr0us <nitrousenador[at]gmail[dot]com>
# milw0rm.com [2006-05-26]OS impact
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 3.8.2-3 |
| sid | Fixed | 3.8.2-3 |
| forky | Fixed | 3.8.2-3 |
| bullseye | Fixed | 3.8.2-3 |
| bookworm | Fixed | 3.8.2-3 |
References
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.