IrfanView ANI Image File Denial Of Service Vulnerability

Bugtraq ID:	19452
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 09 2006 12:00AM
Updated:	Aug 31 2006 09:38PM
Credit:	[email protected] is credited with the discovery of this vulnerability.
Vulnerable:	IrfanView IrfanView 3.98
Not Vulnerable:

IrfanView ANI Image File Denial Of Service Vulnerability

IrfanView is prone to a denial-of-service vulnerability.

A remote attacker may crash the application, resulting in denial-of-service conditions to legitimate users.

This issue may potentially be exploited to execute arbitrary machine code, but this has not been
confirmed.

Version 3.98.0 is vulnerable to this issue; other versions may also be affected.

IrfanView ANI Image File Denial Of Service Vulnerability

A sample exploit written in the Delphi programming language has been provided.

A sample DjVu exploit file has been provided as well:

• /data/vulnerabilities/exploits/irfan-3.98-dos.dpr
• /data/vulnerabilities/exploits/w004_0001.djvu

IrfanView ANI Image File Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

IrfanView ANI Image File Denial Of Service Vulnerability

References:

• IrfanView Web Site (IrfanView)
  
• InfanView 3.98 (with plugins) - Access violation at processing images ANI files ([email protected])