JPEGView 1.0.29 - Crash PoC

2014-07-01T00:00:00
ID SSV:83195
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00

Description

No description provided by source.

                                        
                                            
                                                Title: JPEGView - Image Viewer and Editor RCE POC
Date: 18 November'13
Author: Debasish Mandal ( https://twitter.com/debasishm89 )
Version: JPEGView v1.0.29
Download Link : http://sourceforge.net/projects/jpegview/
Vendor Patch : Patched in version v1.0.30
Issue Ticket : http://sourceforge.net/p/jpegview/bugs/31/
Release Note : http://sourceforge.net/projects/jpegview/files/jpegview/1.0.30/
Tested on: Windows XP SP2

A read access violation near function pointer call can be triggered by feeding a specially crafted 
image(width or height smaller than 65535 ) which could lead to code exec.

The file that causes the AV is attached:

http://www.exploit-db.com/sploits/29707.gif