Sign-up

ID

VAR-200412-0902


CVE

CVE-2004-1307


TITLE

Apple Terminal fails to properly sanitize input for "x-man-page" URI

Trust: 0.8

sources: CERT/CC: VU#356070

DESCRIPTION

Integer overflow in the TIFFFetchStripThing function in tif_dirread.c for libtiff 3.6.1 allows remote attackers to execute arbitrary code via a TIFF file with the STRIPOFFSETS flag and a large number of strips, which causes a zero byte buffer to be allocated and leads to a heap-based buffer overflow. Apple Mac OS X Directory Service utilities use external programs insecurely, potentially allowing an attacker to execute arbitrary code. LibTIFF Library TIFFFetchStripThing() Perform memory allocation in functions CheckMalloc() An integer overflow vulnerability exists due to a flaw in the validation of the value passed to the function.LibTIFF Arbitrary code may be executed with the execution authority of the application that uses the library

Trust: 3.87

sources: NVD: CVE-2004-1307 // CERT/CC: VU#356070 // CERT/CC: VU#539110 // CERT/CC: VU#331694 // JVNDB: JVNDB-2004-000574 // VULHUB: VHN-9737

AFFECTED PRODUCTS

vendor:apple computermodel: - scope: - version: -

Trust: 2.4

vendor:sunmodel:solarisscope:eqversion:7.0

Trust: 1.6

vendor:sunmodel:solarisscope:eqversion:10.0

Trust: 1.6

vendor:sunmodel:solarisscope:eqversion:8.0

Trust: 1.6

vendor:avayamodel:interactive responsescope:eqversion:*

Trust: 1.0

vendor:avayamodel:intuity audix lxscope:eqversion:*

Trust: 1.0

vendor:scomodel:unixwarescope:eqversion:7.1.4

Trust: 1.0

vendor:avayamodel:cvlanscope:eqversion:*

Trust: 1.0

vendor:avayamodel:interactive responsescope:eqversion:1.3

Trust: 1.0

vendor:avayamodel:call management system serverscope:eqversion:9.0

Trust: 1.0

vendor:avayamodel:modular messaging message storage serverscope:eqversion:1.1

Trust: 1.0

vendor:sunmodel:solarisscope:eqversion:9.0

Trust: 1.0

vendor:avayamodel:interactive responsescope:eqversion:1.2.1

Trust: 1.0

vendor:avayamodel:call management system serverscope:eqversion:8.0

Trust: 1.0

vendor:avayamodel:integrated managementscope:eqversion:*

Trust: 1.0

vendor:conectivamodel:linuxscope:eqversion:10.0

Trust: 1.0

vendor:f5model:icontrol service managerscope:eqversion:1.3.6

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.6.0

Trust: 1.0

vendor:f5model:icontrol service managerscope:eqversion:1.3

Trust: 1.0

vendor:mandrakesoftmodel:mandrake linuxscope:eqversion:10.1

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.5.5

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.6

Trust: 1.0

vendor:avayamodel:mn100scope:eqversion:*

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.6

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.5.3

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.6.1

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.5.1

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.5.7

Trust: 1.0

vendor:avayamodel:call management system serverscope:eqversion:13.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.1

Trust: 1.0

vendor:avayamodel:modular messaging message storage serverscope:eqversion:2.0

Trust: 1.0

vendor:mandrakesoftmodel:mandrake linuxscope:eqversion:10.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.5

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.1

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.4

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.4

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.5

Trust: 1.0

vendor:sgimodel:propackscope:eqversion:3.0

Trust: 1.0

vendor:avayamodel:call management system serverscope:eqversion:11.0

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.4

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.7.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.7

Trust: 1.0

vendor:f5model:icontrol service managerscope:eqversion:1.3.4

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.5.4

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.3

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.3

Trust: 1.0

vendor:conectivamodel:linuxscope:eqversion:9.0

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.7

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.8

Trust: 1.0

vendor:sunmodel:sunosscope:eqversion:5.8

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.8

Trust: 1.0

vendor:gentoomodel:linuxscope:eqversion:*

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3

Trust: 1.0

vendor:sunmodel:sunosscope:eqversion:5.7

Trust: 1.0

vendor:libtiffmodel:libtiffscope:eqversion:3.5.2

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3

Trust: 1.0

vendor:mandrakesoftmodel:mandrake linux corporate serverscope:eqversion:3.0

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.9

Trust: 1.0

vendor:f5model:icontrol service managerscope:eqversion:1.3.5

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.3.2

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.9

Trust: 1.0

vendor:applemodel:mac os x serverscope:eqversion:10.3.2

Trust: 1.0

vendor:avayamodel:call management system serverscope:eqversion:12.0

Trust: 1.0

vendor:red hatmodel: - scope: - version: -

Trust: 0.8

vendor:sun microsystemsmodel: - scope: - version: -

Trust: 0.8

vendor:applemodel:mac os xscope:eqversion:v10.3.9

Trust: 0.8

vendor:applemodel:mac os x serverscope:eqversion:v10.3.9

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:10 (sparc)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:10 (x86)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:7.0 (sparc)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:7.0 (x86)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:8 (sparc)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:8 (x86)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:9 (sparc)

Trust: 0.8

vendor:sun microsystemsmodel:solarisscope:eqversion:9 (x86)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:2.1 (as)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:2.1 (es)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:2.1 (ws)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:3 (as)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:3 (es)

Trust: 0.8

vendor:red hatmodel:enterprise linuxscope:eqversion:3 (ws)

Trust: 0.8

vendor:red hatmodel:enterprise linux desktopscope:eqversion:3.0

Trust: 0.8

vendor:red hatmodel:linux advanced workstationscope:eqversion:2.1

Trust: 0.8

sources: CERT/CC: VU#356070 // CERT/CC: VU#539110 // CERT/CC: VU#331694 // JVNDB: JVNDB-2004-000574 // CNNVD: CNNVD-200412-081 // NVD: CVE-2004-1307

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2004-1307
value: HIGH

Trust: 1.0

CARNEGIE MELLON: VU#356070
value: 22.31

Trust: 0.8

CARNEGIE MELLON: VU#539110
value: 5.04

Trust: 0.8

CARNEGIE MELLON: VU#331694
value: 15.94

Trust: 0.8

NVD: CVE-2004-1307
value: HIGH

Trust: 0.8

CNNVD: CNNVD-200412-081
value: HIGH

Trust: 0.6

VULHUB: VHN-9737
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2004-1307
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-9737
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#356070 // CERT/CC: VU#539110 // CERT/CC: VU#331694 // VULHUB: VHN-9737 // JVNDB: JVNDB-2004-000574 // CNNVD: CNNVD-200412-081 // NVD: CVE-2004-1307

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2004-1307

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200412-081

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-200412-081

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2004-000574

PATCH
title:Security Update 2005-005url:http://docs.info.apple.com/article.html?artnum=301528
Trust: 0.8
title:Security Update 2005-005url:http://docs.info.apple.com/jarticle.html?artnum=301528
Trust: 0.8
title:RHSA-2004:577url:https://rhn.redhat.com/errata/RHSA-2004-577.html
Trust: 0.8
title:101677url:http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1
Trust: 0.8
title:RHSA-2004:577url:http://www.jp.redhat.com/support/errata/RHSA/RHSA-2004-577J.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2004-000574

EXTERNAL IDS
db:CERT/CCid:VU#539110
Trust: 3.3
db:USCERTid:TA05-136A
Trust: 2.5
db:NVDid:CVE-2004-1307
Trust: 2.5
db:SECUNIAid:15227
Trust: 2.4
db:OSVDBid:16084
Trust: 0.8
db:BIDid:13502
Trust: 0.8
db:CERT/CCid:VU#356070
Trust: 0.8
db:SECTRACKid:1012651
Trust: 0.8
db:SECUNIAid:13607
Trust: 0.8
db:OSVDBid:16075
Trust: 0.8
db:XFid:20376
Trust: 0.8
db:CERT/CCid:VU#331694
Trust: 0.8
db:JVNDBid:JVNDB-2004-000574
Trust: 0.8
db:CNNVDid:CNNVD-200412-081
Trust: 0.7
db:CERT/CCid:TA05-136A
Trust: 0.6
db:OVALid:OVAL:ORG.MITRE.OVAL:DEF:11175
Trust: 0.6
db:SUNALERTid:101677
Trust: 0.6
db:SUNALERTid:201072
Trust: 0.6
db:APPLEid:APPLE-SA-2005-05-03
Trust: 0.6
db:IDEFENSEid:20041221 LIBTIFF STRIPOFFSETS INTEGER OVERFLOW VULNERABILITY
Trust: 0.6
db:VULHUBid:VHN-9737
Trust: 0.1
sources:
            
            
            CERT/CC: VU#356070 // 
            
            
            
            CERT/CC: VU#539110 // 
            
            
            
            CERT/CC: VU#331694 // 
            
            
            
            VULHUB: VHN-9737 // 
            
            
            
            JVNDB: JVNDB-2004-000574 // 
            
            
            
            CNNVD: CNNVD-200412-081 // 
            
            
            
            NVD: CVE-2004-1307

REFERENCES
url:http://www.us-cert.gov/cas/techalerts/ta05-136a.html
Trust: 2.5
url:http://www.kb.cert.org/vuls/id/539110
Trust: 2.5
url:http://secunia.com/advisories/15227/
Trust: 2.4
url:http://lists.apple.com/archives/security-announce/2005/may/msg00001.html
Trust: 1.7
url:http://sunsolve.sun.com/search/document.do?assetkey=1-26-101677-1
Trust: 1.7
url:http://sunsolve.sun.com/search/document.do?assetkey=1-66-201072-1
Trust: 1.7
url:http://docs.info.apple.com/article.html?artnum=301528
Trust: 1.6
url:http://www.idefense.com/application/poi/display?id=173&type=vulnerabilities&flashstatus=true
Trust: 1.6
url:https://oval.cisecurity.org/repository/search/definition/oval%3aorg.mitre.oval%3adef%3a11175
Trust: 1.1
url:http://remahl.se/david/vuln/011/
Trust: 0.8
url:http://www.securityfocus.com/bid/13502/
Trust: 0.8
url:http://www.osvdb.org/displayvuln.php?osvdb_id=16084
Trust: 0.8
url:http://securitytracker.com/alerts/2004/dec/1012651.html
Trust: 0.8
url:http://www.idefense.com/application/poi/display?id=173&type=vulnerabilities
Trust: 0.8
url:http://secunia.com/advisories/13607/
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/20376
Trust: 0.8
url:http://www.apple.com/server/macosx/
Trust: 0.8
url:http://www.osvdb.org/16075
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2004-1307
Trust: 0.8
url:http://www.jpcert.or.jp/wr/2005/wr052001.txt
Trust: 0.8
url:http://jvn.jp/cert/jvnta05-136a/
Trust: 0.8
url:http://jvn.jp/tr/trta05-136a/
Trust: 0.8
url:http://nvd.nist.gov/nvd.cfm?cvename=cve-2004-1307
Trust: 0.8
url:http://oval.mitre.org/repository/data/getdef?id=oval:org.mitre.oval:def:11175
Trust: 0.6
url:http://www.idefense.com/application/poi/display?id=173&type=vulnerabilities&flashstatus=true
Trust: 0.1
sources:
            
            
            CERT/CC: VU#356070 // 
            
            
            
            CERT/CC: VU#539110 // 
            
            
            
            CERT/CC: VU#331694 // 
            
            
            
            VULHUB: VHN-9737 // 
            
            
            
            JVNDB: JVNDB-2004-000574 // 
            
            
            
            CNNVD: CNNVD-200412-081 // 
            
            
            
            NVD: CVE-2004-1307

CREDITS
Discovery credited to infamous41md[at]hotpop.com.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200412-081

SOURCES
db:CERT/CCid:VU#356070
db:CERT/CCid:VU#539110
db:CERT/CCid:VU#331694
db:VULHUBid:VHN-9737
db:JVNDBid:JVNDB-2004-000574
db:CNNVDid:CNNVD-200412-081
db:NVDid:CVE-2004-1307

LAST UPDATE DATE
2025-02-20T20:54:45.877000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#356070date:2005-05-16T00:00:00
db:CERT/CCid:VU#539110date:2005-08-23T00:00:00
db:CERT/CCid:VU#331694date:2005-05-25T00:00:00
db:VULHUBid:VHN-9737date:2018-10-30T00:00:00
db:JVNDBid:JVNDB-2004-000574date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200412-081date:2009-02-05T00:00:00
db:NVDid:CVE-2004-1307date:2018-10-30T16:26:22.763

SOURCES RELEASE DATE
db:CERT/CCid:VU#356070date:2005-05-06T00:00:00
db:CERT/CCid:VU#539110date:2005-01-20T00:00:00
db:CERT/CCid:VU#331694date:2005-05-16T00:00:00
db:VULHUBid:VHN-9737date:2004-12-21T00:00:00
db:JVNDBid:JVNDB-2004-000574date:2007-04-01T00:00:00
db:CNNVDid:CNNVD-200412-081date:2004-12-21T00:00:00
db:NVDid:CVE-2004-1307date:2004-12-21T05:00:00