Visual Component Library BMP File Handling Local Buffer Overflow Vulnerability

Bugtraq ID:	69315
Class:	Boundary Condition Error
CVE:	CVE-2014-0993
Remote:	No
Local:	Yes
Published:	Aug 20 2014 12:00AM
Updated:	Sep 12 2014 01:57PM
Credit:	Marcos Accossatto from the Core Exploits Writers Team.
Vulnerable:
Not Vulnerable:

Visual Component Library BMP File Handling Local Buffer Overflow Vulnerability

Visual Component Library is prone to a local buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied input.

Note: Applications developed with Delphi and C++ Builder that use Visual Component Library (VCL) are affected. Windows 32 bits compiled projects are only affected.

Local attackers can exploit these issues to execute arbitrary code in the context of the application. Failed exploit attempts may result in a denial-of-service condition.

Visual Component Library BMP File Handling Local Buffer Overflow Vulnerability

Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

Visual Component Library BMP File Handling Local Buffer Overflow Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Visual Component Library BMP File Handling Local Buffer Overflow Vulnerability

References: