GFL SDK Library Buffer Overflow Vulnerability

Bugtraq ID:	27514
Class:	Boundary Condition Error
CVE:	CVE-2008-0064
Remote:	Yes
Local:	No
Published:	Jan 30 2008 12:00AM
Updated:	Apr 29 2009 08:46PM
Credit:	Stefan Cornelius, Secunia Research discovered this issue.
Vulnerable:	XnView XnView Standard 1.92 XnView XnView Standard 1.91 XnView NConvert 4.85 XnView GFL SDK 2.870
Not Vulnerable:	XnView XnView Standard 1.92.1 XnView NConvert 4.86

GFL SDK Library Buffer Overflow Vulnerability

GFL SDK library is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue may allow remote attackers to execute arbitrary code in the context of the application using the library. Failed exploit attempts likely result in denial-of-service conditions.

GFL SDK 2.870 is vulnerable. The issue also affects XnView 1.91 and 1.92, which use the library, and NConvert 4.85; other versions may be affected as well.

GFL SDK Library Buffer Overflow Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

GFL SDK Library Buffer Overflow Vulnerability

Solution:
Reportedly, the vendor released XnView 1.92.1 and NConvert 4.86 to address this issue. Please contact the vendor for more information.

GFL SDK Library Buffer Overflow Vulnerability

References:

• GFL SDK Homepage (XnView)
  
• NConvert Homepage (XnView)
  
• XnView Homepage (XnView)
  
• XnView, NConvert, and GFL SDK Radiance RGBE Buffer Overflow (Secunia Research)