IrfanView JLS Formats PlugIn Heap Overflow

Summary
=======
 
IrfanView Formats PlugIn is prone to an overflow condition. The JLS Plugin
(jpeg_ls.dll) library fails to properly sanitize user-supplied input
resulting in a heap-based buffer overflow. With a specially crafted JLS
compressed image file, a context-dependent attacker could potentially
execute arbitrary code.
 
CVE number: CVE-2012-3585
Impact: high
Vendor Homepage: http://www.ifranview.com/
Vendor Notified: 16/06/2012
Found by: Joseph Sheridan of Reaction Information Security
href="http://www.reactionpenetrationtesting.co.uk/joseph-sheridan.html
 
This advisory is posted at:
http://www.reactionpenetrationtesting.co.uk/Irfanview-JLS-Heap-Overflow.
html
 
POC file posted at:
http://www.reactionpenetrationtesting.co.uk/vuln.jls
http://www.exploit-db.com/sploits/19483.jls
 
 
Affected Products
=================
 
Irfanview Plugins version 4.33
 
Details
=======
 
IrfanView Formats PlugIn is prone to an overflow condition. The JLS Plugin
(jpeg_ls.dll) library fails to properly sanitize user-supplied input
resulting in a heap-based buffer overflow. With a specially crafted JLS
compressed image file, a context-dependent attacker could potentially
execute arbitrary code.
 
Impact
======
 
If a user could be enticed to open a malicious JLS file, the attack could
result in remote code execution.
 
Solution
===========
Upgrade to Irfanview Plugins version 4.34
 
The following jls dll has been patched:
http://www.irfanview.net/plugins/jpeg_ls.zip
 
Distribution
============
 
In addition to posting on the website, a text version of this notice
is posted to the following e-mail and Usenet news recipients.
 
* bugtraq () securityfocus com
* full-disclosure () lists grok org uk
* oss [dash] security [dash] subscribe [at] lists [dot] openwall [dot] com or
 
Future updates of this advisory, if any, will be placed on the ReactionIS
corporate website, but may or may not be actively announced on
mailing lists or newsgroups. Users concerned about this problem are
encouraged to check the URL below for any updates:
 
http://www.reactionpenetrationtesting.co.uk/Irfanview-JLS-Heap-Overflow.
html
 
========================================================================
======



#  0day.today [2018-02-20]  #