About Us | Contact Us

 


 

VUPEN Free Resources

 
  VUPEN Security Advisories
 
  VUPEN Security Blog & News
  Zero-day Attacks Monitor
  Daily Security Mailinglist
  Explanation of Terms
  Advanced Search Engine
 
   

ACDSee Products TIFF and Font Parsing Buffer Overflow Vulnerabilities

VUPEN ID VUPEN/ADV-2009-1471
CVE ID GENERIC-MAP-NOMATCH
 
CWE ID Available in VUPEN VNS Customer Area
CVSS V2 Available in VUPEN VNS Customer Area
Rated as Critical 
Impact Available in VUPEN VNS Customer Area
Authentication Level Available in VUPEN VNS Customer Area
Access Vector Available in VUPEN VNS Customer Area
Release Date 2009-06-02
Share Twitter LinkedIn Facebook Delicious Digg Slashdot

Technical Description

Two vulnerabilities have been identified in various ACDSee products, which could be exploited by attackers to compromise a vulnerable system.

The first issue is caused by a buffer overflow error when parsing a specially crafted TIFF image, which could be exploited to crash an affected application or execute arbitrary code by tricking a user into opening a malicious image.

The second vulnerability is caused by a buffer overflow error when parsing specially crafted Fonts, which could be exploited to crash an affected application or execute arbitrary code by tricking a user into opening a malicious file.

Affected Products

ACDSee 11.x
ACDSee 10.x
ACDSee 9.x
ACDSee Photo Manager 2009
ACDSee Photo Manager 2008
ACDSee Pro Photo Manager version 2.5 and prior

Solution 

VUPEN Security is not aware of any vendor-supplied patch.

References

http://www.vupen.com/english/advisories/2009/1471

In-depth Binary Analysis 

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Private Exploit or PoC 

Available in customer area as part of VUPEN Binary Analysis & Exploits Service and VUPEN Vulnerability Notification Service Ultimate Feed Edition.
 

Credits 

Vulnerabilities reported by Nicolas Joly of VUPEN Security.

Changelog 

2009-04-08 : Vendor contacted
2009-04-15 : Vendor contacted again. No response.
2009-04-23 : Vendor contacted again. No response.
2009-05-06 : Vendor contacted again. No response.
2009-05-25 : Vendor contacted again. No response.
2009-06-02 : Initial release

Feedback 

If you have additional information or corrections for this security advisory please submit them via our contact form.

 

Monthly Statistics 

 

 VUPEN Security Advisories By Criticality: Aug 2010


  Critical Risk

: 0%

  High Risk
: 0%

  Moderate Risk
: 0%

  Low Risk
: 100%

Get a real-time view of the vulnerabilities affecting your systems using the VUPEN VNS reporting capabilities.
 

 

Try VUPEN VNS 

 

 





© 2004-2010 VUPEN Security - Copyright - Privacy Policy