Red Hat セキュリティアドバイザリ 2006:0648 から：

kfax における複数のセキュリティ欠陥を修正する更新済みの kdegraphics パッケージが、Red Hat Enterprise Linux 2.1 および 3 で現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新は重要度中のセキュリティ影響があると評価しています。

kdegraphics パッケージには、K Desktop Environment 用のグラフィックアプリケーションが含まれています。

Google の Tavis Ormandy 氏は、セキュリティ監査中の多数の欠陥を libtiff に発見しました。kfax アプリケーションには、TIFF ファイルの解析に使用される libtiff コードのコピーが含まれています。そのため、kfax アプリケーションは、これらの脆弱性に影響を受けます。ユーザーを騙して悪意のある TIFF ファイルを開かせることのできる攻撃者が、kfax をクラッシュさせたり、任意のコードを実行する可能性があります。（CVE-2006-3459、CVE-2006-3460、CVE-2006-3461、CVE-2006-3462、CVE-2006-3463、CVE-2006-3464、CVE-2006-3465）

Red Hat Enterprise Linux 4 は、これらの問題に対して脆弱ではありません。これは、kfax が以前の更新で修正された、共有 libtiff ライブラリを使用しているためです。

kfax のユーザーは、この問題に対する脆弱性がない、バックポートされたパッチが含まれるこれらの更新済みパッケージにアップグレードする必要があります。

Tavis Ormandy and Andrey Kiselev discovered that libtiff did not sufficiently verify the validity of TIFF files. By tricking an user into opening a specially crafted TIFF file with any application that uses libtiff, an attacker could exploit this to crash the application or even execute arbitrary code with the application's privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2006:0648 :

Updated kdegraphics packages that fix several security flaws in kfax are now available for Red Hat Enterprise Linux 2.1, and 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdegraphics package contains graphics applications for the K Desktop Environment.

Tavis Ormandy of Google discovered a number of flaws in libtiff during a security audit. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these flaws. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. (CVE-2006-3459, CVE-2006-3460, CVE-2006-3461, CVE-2006-3462, CVE-2006-3463, CVE-2006-3464, CVE-2006-3465)

Red Hat Enterprise Linux 4 is not vulnerable to these issues as kfax uses the shared libtiff library which has been fixed in a previous update.

Users of kfax should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue.

Several bugs were discovered in libtiff that can lead to remote Denial of Service attacks. These bugs can only be triggered by a user using an application that uses libtiff to process malformed TIFF images.

The updated packages have been patched to correct these issues.

Updated kdegraphics packages that fix several security flaws in kfax are now available for Red Hat Enterprise Linux 2.1, and 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The kdegraphics package contains graphics applications for the K Desktop Environment.

Tavis Ormandy of Google discovered a number of flaws in libtiff during a security audit. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these flaws. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. (CVE-2006-3459, CVE-2006-3460, CVE-2006-3461, CVE-2006-3462, CVE-2006-3463, CVE-2006-3464, CVE-2006-3465)

Red Hat Enterprise Linux 4 is not vulnerable to these issues as kfax uses the shared libtiff library which has been fixed in a previous update.

Users of kfax should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue.

Tavis Ormandy discovered several vulnerabilities in the TIFF library that can lead to a denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-2024     Multiple vulnerabilities allow attackers to cause a     denial of service.

  - CVE-2006-2025     An integer overflow allows attackers to cause a denial     of service and possibly execute arbitrary code.

  - CVE-2006-2026     A double-free vulnerability allows attackers to cause a     denial of service and possibly execute arbitrary code.

Updated libtiff packages that fix several security flaws are now available for Red Hat Enterprise Linux.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The libtiff package contains a library of functions for manipulating TIFF (Tagged Image File Format) image format files.

An integer overflow flaw was discovered in libtiff. An attacker could create a carefully crafted TIFF file in such a way that it could cause an application linked with libtiff to crash or possibly execute arbitrary code. (CVE-2006-2025)

A double free flaw was discovered in libtiff. An attacker could create a carefully crafted TIFF file in such a way that it could cause an application linked with libtiff to crash or possibly execute arbitrary code. (CVE-2006-2026)

Several denial of service flaws were discovered in libtiff. An attacker could create a carefully crafted TIFF file in such a way that it could cause an application linked with libtiff to crash.
(CVE-2006-2024, CVE-2006-2120)

All users are advised to upgrade to these updated packages, which contain backported fixes for these issues.

来自 Red Hat 安全公告 2006:0648：

更新后的 kdegraphics 程序包修复了 kfax 中的多个安全缺陷，现在可用于 Red Hat Enterprise Linux 2.1 和 3。

Red Hat 安全响应团队将此更新评级为具有中等安全影响。

kdegraphics 程序包包含用于 K Desktop Environment 的图形应用程序。

Google 的 Tavis Ormandy 在安全审计期间发现 libtiff 有多个缺陷。kfax 应用程序包含用于解析 TIFF 文件的 libtiff 代码副本，因此受到这些缺陷的影响。能够诱骗用户打开恶意 TIFF 文件的攻击者可造成 kfax 崩溃或可能执行任意代码。（CVE-2006-3459、CVE-2006-3460、CVE-2006-3461、CVE-2006-3462、CVE-2006-3463、CVE-2006-3464、CVE-2006-3465）

Red Hat Enterprise Linux 4 不易受到这些问题的影响，因为 kfax 使用共享的 libtiff 库，该库在以前的更新中已修复。

kfax 用户应升级这些更新后的程序包，其中包含向后移植的修补程序，因此不易受此问题的影响。

來自 Red Hat 安全性公告 2006:0648：

現已提供適用於 Red Hat Enterprise Linux 2.1 和 3 的更新版 kdegraphics 套件，可修正數個安全性瑕疵。

Red Hat 安全性回應團隊已將此更新評等為具有中等安全性影響。

kdegraphics 套件含有適用於 K Desktop Environment 的圖形應用程式。

Google 的 Tavis Ormandy 發現在進行安全性稽核時，libtiff 中有數個瑕疵。kfax 應用程式含有用於剖析 TIFF 檔案的 libtiff 程式碼複本，因此會受到這些瑕疵影響。攻擊者只要能引誘使用者開啟惡意的 TIFF 檔，就能造成 kfax 損毀或可能執行任意程式碼。(CVE-2006-3459、CVE-2006-3460、CVE-2006-3461、CVE-2006-3462、CVE-2006-3463、CVE-2006-3464、CVE-2006-3465)

不過 Red Hat Enterprise Linux 4 不易受這些問題的影響，因為 kfax 所用的共用 libtiff 程式庫已在之前的更新中修正。

kfax 使用者應升級至這些更新版套件，其中包含反向移植修補程式，且不易受此問題影響。

The remote host is affected by the vulnerability described in GLSA-200605-17 (libTIFF: Multiple vulnerabilities)

    Multiple vulnerabilities, ranging from integer overflows and NULL     pointer dereferences to double frees, were reported in libTIFF.
  Impact :

    An attacker could exploit these vulnerabilities by enticing a user     to open a specially crafted TIFF image, possibly leading to the     execution of arbitrary code or a Denial of Service.
  Workaround :

    There is no known workaround at this time.

ID	名稱	產品	系列	已發布	已更新	嚴重性
67404	Oracle Linux 3：kdegraphics（ELSA-2006-0648）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
21371	Ubuntu 5.04 / 5.10 : tiff vulnerabilities (USN-277-1)	Nessus	Ubuntu Local Security Checks	2006/5/13	2021/1/19	medium
67404	Oracle Linux 3 : kdegraphics (ELSA-2006-0648)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
21357	Mandrake Linux Security Advisory : libtiff (MDKSA-2006:082)	Nessus	Mandriva Local Security Checks	2006/5/13	2021/1/6	medium
22293	RHEL 2.1 / 3 : kdegraphics (RHSA-2006:0648)	Nessus	Red Hat Local Security Checks	2006/8/30	2021/1/14	high
22596	Debian DSA-1054-1 : tiff - several vulnerabilities	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	medium
21900	CentOS 3 / 4 : libtiff (CESA-2006:0425)	Nessus	CentOS Local Security Checks	2006/7/3	2021/1/4	medium
67404	Oracle Linux 3：kdegraphics (ELSA-2006-0648)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
67404	Oracle Linux 3 : kdegraphics (ELSA-2006-0648)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
21365	RHEL 2.1 / 3 / 4 : libtiff (RHSA-2006:0425)	Nessus	Red Hat Local Security Checks	2006/5/13	2021/1/14	medium
21615	GLSA-200605-17 : libTIFF: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2006/5/31	2021/1/6	medium
22282	CentOS 3 : kdegraphics (CESA-2006:0648)	Nessus	CentOS Local Security Checks	2006/8/30	2021/1/4	high

偵測

搜尋 Plugin

high

medium

high

medium

high

medium

medium

high

high

medium

medium

high