Multiple ACDSee Products 'XMB' File Remote Buffer Overflow Vulnerability

Bugtraq ID:	37685
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 08 2010 12:00AM
Updated:	Jan 08 2010 12:00AM
Credit:	Vulnerability Research Team, TELUS Security Labs
Vulnerable:	ACD Systems Inc ACDSee Photo Manager 9.0 build 108 ACD Systems Inc ACDSee Photo Manager 9.0 ACD Systems Inc ACDSee Photo Manager 8.1 build 99 ACD Systems Inc ACDSee Photo Manager 8.1 ACD Systems Inc ACDSee Photo Editor 2008 build 286 ACD Systems Inc ACDSee Photo Editor 4.0
Not Vulnerable:

Multiple ACDSee Products 'XMB' File Remote Buffer Overflow Vulnerability

Multiple ACDSee products are prone to a remote buffer-overflow vulnerability because they fail to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

The following are vulnerable:

ACDSee Photo Editor 2008 build 286 and prior
ACDSee Photo Manager 8.1 build 99 and prior
ACDSee Photo Manager 9.0 build 108 and prior

Multiple ACDSee Products 'XMB' File Remote Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple ACDSee Products 'XMB' File Remote Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple ACDSee Products 'XMB' File Remote Buffer Overflow Vulnerability

References:

• ACDSee Homepage (ACD Systems)
  
• TELUS Security Labs VR - ACDSee Systems ACDSee Products XBM File Handling Buffer ([email protected])