2008.08.31 21:52 "Re: [Tiff] Some security fixes from RHEL", by Toby Thain

On 31-Aug-08, at 6:09 PM, Rogier Wolff wrote:

On Sun, Aug 31, 2008 at 10:38:01AM -0500, Bob Friesenhahn wrote:

If an application needs to be secure/stable in the face of hostile files then it should not link against libtiff.

I would like to be able to view tiff files. Maybe some NASA site (*) has "tiff" as the "higher quality" images.

My image viewer of choice is: gqview. But you're saying that because it's linked against libtiff, I shouldn't be using it.

Or that because gqview might be run on files from the internet, gqview should not link against libtiff.

So, because I might download an image from the internet, and try to modify it using the gimp, GIMP should not link against libtiff.

Because Imagemagick might be used to convert an image from the internet, imagemagick should not link against libtiff.

As a response to all the threats above, it looks like libtiff needs some auditing and hardening. This is a community opportunity! Google Summer of Code, anyone?

Hylafax is used on tiff files recieved from fax machines on the other end. Some malicious user might send invalid tiff files.

All of your other examples are reasonable, but this one is practically impossible, as the fax protocol does not transfer "a TIFF file" per se, but is an extremely narrowly defined protocol with extensive verification and handshaking. TIFF is only a convenient wrapper, created post facto, for the verified compressed multipage transmission. In other words, afaik, you can't insert "an arbitrary TIFF" in the sending end of the call and expect that to pop out the other end.

--Toby

My system lists 199 packages as depending on libtiff. Over half cannot guarantee that they won't be run on data from the internet.

For the record, I find your statement rediculous.

        Roger.

(*) You'd say that I could "trust" the NASA. However, nasa delivers the TIFF files unencrypted, so they might be modified en-route, or with for example the recent DNS exploit, I might be browsing a hacked-side pretending to be NASA.