Is CVE-2017-5563 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-5563 being exploited in the wild.

How severe is CVE-2017-5563?

High severity, with a CVSS score of 8.8, published 23 January 2017.

Is there a fix for CVE-2017-5563?

A patch was published on 2017-09-26: Gentoo released fixed version 4.0.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-5563 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2017-5563?

Check whether you run Libtiff. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-5563: LibTIFF heap buffer over-read in tif_lzw.c via bmp2tiff

CVE-2017-5563 · Severity: high · CVSS 8.8 · Published 2017-01-23

LibTIFF is a widely used library for processing TIFF image files. A vulnerability in its image conversion tools allows an attacker to crash applications or potentially execute malicious code if a user is tricked into processing a specially crafted BMP image. This could lead to a complete system compromise or a disruption of services that handle image uploads.

Technologies: Libtiff. Vendors: Libtiff.

Quick answers

Is CVE-2017-5563 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-5563 being exploited in the wild.
How severe is CVE-2017-5563?: High severity, with a CVSS score of 8.8, published 23 January 2017.
Which products and versions are affected?: LibTIFF LibTIFF 4.0.7.
Is there a fix for CVE-2017-5563?: A patch was published on 2017-09-26: Gentoo released fixed version 4.0.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-5563 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2017-5563?: Check whether you run Libtiff. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer over-read exists in the LZWEncode function within tif_lzw.c of LibTIFF 4.0.7. The vulnerability is triggered when the bmp2tiff utility processes a specially crafted BMP image using LZW compression. An attacker can exploit this by providing a malformed BMP file that causes the encoder to read beyond the allocated memory buffer. This can result in an application crash (DoS) or, in some scenarios, the execution of arbitrary code. While the bmp2tiff tool was later removed from the upstream project to mitigate the issue, users of version 4.0.7 should upgrade to version 4.0.8 or apply vendor-specific patches.

Affected products

LibTIFF LibTIFF 4.0.7

Timeline

2017-01-18: disclosed: Bug reported to LibTIFF Bugzilla
2017-01-23: advisory: NVD published CVE-2017-5563
2017-04-27: other: Upstream marked as WONTFIX after removing the affected bmp2tiff tool
2017-09-26: patched: Gentoo released fixed version 4.0.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.