BID:16400

Exiv2 Corrupted EXIF Data Denial Of Service Vulnerability

Info

Exiv2 Corrupted EXIF Data Denial Of Service Vulnerability

Bugtraq ID:	16400
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Jan 26 2006 12:00AM
Updated:	Feb 07 2006 08:54PM
Credit:	Maciek reported this issue to the vendor.
Vulnerable:	Andreas Huggel Exiv2 0.6.2 Andreas Huggel Exiv2 0.6.1 Andreas Huggel Exiv2 0.8 Andreas Huggel Exiv2 0.7 Andreas Huggel Exiv2 0.6 Andreas Huggel Exiv2 0.5 Andreas Huggel Exiv2 0.4 Andreas Huggel Exiv2 0.3

Not Vulnerable:	Andreas Huggel Exiv2 0.9

Discussion

Exiv2 Corrupted EXIF Data Denial Of Service Vulnerability

Exiv2 is susceptible to a denial-of-service vulnerability. This issue is due to the application's failure to properly bounds-check user-supplied input data before attempting to read it, resulting in an out-of-bounds memory access crash.

This issue allows attackers to crash applications that use the affected library to process malicious image data. Depending on the nature of applications, this may be local or remote in nature.

This issue is present in Exiv2 versions prior to 0.9.

Exploit / POC

Exiv2 Corrupted EXIF Data Denial Of Service Vulnerability

An example image file sufficient to exploit this issue is available:

/data/vulnerabilities/exploits/exiv2-bug447.jpg

Solution / Fix

Exiv2 Corrupted EXIF Data Denial Of Service Vulnerability

Solution:
The vendor has released version 0.9 of Exiv2 to address this issue:

Andreas Huggel Exiv2 0.6