CVE-2005-1544

Remote attackers can trigger this vulnerability by providing a specially crafted TIFF file containing a malformed BitsPerSample tag [ref_id=1]. When the libTIFF library attempts to read and process this malformed tag, it can lead to a stack-based buffer overflow. This overflow can be exploited to overwrite critical data on the stack, potentially allowing an attacker to execute arbitrary code.

The vulnerability lies within the libTIFF library, specifically in how it handles TIFF files with malformed BitsPerSample tags. The provided exploit code targets the `tiffinfo` utility, suggesting that the parsing logic within libTIFF is susceptible to this overflow [ref_id=1].

The advisory indicates that libTIFF versions prior to 3.7.2 are affected. The fix involves updating the libTIFF library to version 3.7.2 or later. This update is expected to correct the input validation or handling of the BitsPerSample tag, preventing the buffer overflow condition.

```bash # Tested on LibTIFF 3.7.1 # Coded by Agustin Gianni (agustingianni at gmail.com) and Samelat

# Compile the exploit make libtiff_exploit

# Execute the exploit ./libtiff_exploit /usr/local/bin/tiffinfo evil.tiff ```