ACD Systems ACDSee Photo Album File Description Buffer Overflow Vulnerability
BID:4719
Info
ACD Systems ACDSee Photo Album File Description Buffer Overflow Vulnerability
| Bugtraq ID: | 4719 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 10 2002 12:00AM |
| Updated: | May 10 2002 12:00AM |
| Credit: | Reported by Markus Arndt <[email protected]>. |
| Vulnerable: |
Acdsystems Acdsee 4.0 |
| Not Vulnerable: | |
Discussion
ACD Systems ACDSee Photo Album File Description Buffer Overflow Vulnerability
ACDSee is an image viewing, conversion and management tool for Microsoft Windows based machines. ACDSee defines a Photo Album file format, associated with the .ais file extension.
The .ais file is text formatted, with each line containing an absolute path and image followed by a description. Reportedly, including a description longer than 256 characters may cause ACDSee to crash when the file properties are viewed. If this condition is a buffer overflow, execution of arbitrary code may be possible.
ACDSee is an image viewing, conversion and management tool for Microsoft Windows based machines. ACDSee defines a Photo Album file format, associated with the .ais file extension.
The .ais file is text formatted, with each line containing an absolute path and image followed by a description. Reportedly, including a description longer than 256 characters may cause ACDSee to crash when the file properties are viewed. If this condition is a buffer overflow, execution of arbitrary code may be possible.
Exploit / POC
ACD Systems ACDSee Photo Album File Description Buffer Overflow Vulnerability
As a proof of concept, the .ais text file may be manually edited to include a description longer than 256 characters.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
As a proof of concept, the .ais text file may be manually edited to include a description longer than 256 characters.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
ACD Systems ACDSee Photo Album File Description Buffer Overflow Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
ACD Systems ACDSee Photo Album File Description Buffer Overflow Vulnerability
References:
References:
- ACDSee Homepage (ACD Systems)