ACDSee Products Image and Archive Plug-ins Buffer Overflows
4 Nov. 2007
Summary
"ACDSee provides everything you need to make the most of your digital memories." Secunia Research has discovered some vulnerabilities in ACDSee products, which can be exploited by malicious people to compromise a user's system.
Vulnerable Systems:
* ACDSee Photo Manager version 9.0 build 108
* ACDSee Pro Photo Manager version 8.1 build 99
* ACDSee Photo Editor version 4.0 build 195
The following issues have been discovered in ACDSee:
1) An input validation error within ID_PSP.apl when processing PSP image files can be exploited to cause a heap-based buffer overflow via a specially crafted PSP image file.
2) An integer overflow error within ID_PSP.apl when processing PSP image files can be exploited to cause a heap-based buffer overflow via a specially crafted PSP image file.
3) An input validation error within AM_LHA.apl when processing LHA archives can be exploited to cause a heap-based buffer overflow via a specially crafted LHA archive.
NOTE: The AM_LHA.apl plugin is not included in a default install of ACDSee Photo Editor.
Successful exploitation of the vulnerabilities allows execution of arbitrary code.
