bugtraq - nSense-2011-001: VeryPDF pdf2tif

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <BANLkTikFLnvpm57neV04ON0nV6wb+v4xqw@mail.gmail.com>
Date: Wed, 13 Apr 2011 11:28:22 +0300
From: Henri Lindberg <henri+lists@...nse.fi>
To: bugtraq@...urityfocus.com
Subject: nSense-2011-001: VeryPDF pdf2tif

       nSense Vulnerability Research Security Advisory NSENSE-2011-001
       ---------------------------------------------------------------

       Affected Vendor:    VeryPDF (+ Multiple others, eg
                           Barcode Reader Tookit version 7.4.1.3 )
       Affected Product:   PDF Extract TIFF COM (prior to April 8'th)
       Platform:           Windows
       Impact:             Local/Remote code execution
       Vendor response:    Patch
       CVE:                None
       CVSS2:              9.3 - (AV:N/AC:M/Au:N/C:C/I:C/A:C)
       Credit:             JODE

       Technical details
       ---------------------------------------------------------------

       A PDF file format parsing vulnerability exists in the pdf2tif
       parser and can be exploited with a specially crafted input
       file. The plugin suffers from a buffer overflow flaw.

       Many server side applications use the library when converting
       pdf files to images. If an attacker is able to send the
       application a malicious file, successful exploitation leads to
       code being executed in  the context of the running application.

       Solution
       Upgrade to the latest version of the pdf2tif.dll.

       Timeline:
       April    1th                  Contacted vendor
       April    1th                  Vendor responded, requesting gold
	                             support license agreement number.
       April    8th                  Vendor released the fix
       April    12th                 Advisory released

       Links:
       http://www.nsense.fi                       http://www.nsense.dk



       $$s$$$$s.   ,s$$$$s   ,S$$$$$s.  $$s$$$$s.   ,s$$$$s   ,S$$$$$s.
       $$$  `$$$  ($$(       $$$  `$$$  $$$  `$$$  ($$(       $$$  `$$$
       $$$   $$$    `^$$s.   $$$$$$$$$  $$$   $$$    `^$$s.   $$$$$$$$$
       $$$   $$$       )$$)  $$$        $$$   $$$       )$$)  $$$
       $$$   $$$  ^$$$$$$7    `7$$$$$P  $$$   $$$  ^$$$$$$7   `7$$$$$P

                      D r i v e n   b y   t h e   c h a l l e n g e _