|
|
| |
| IrfanView is "a very fast, small, compact and innovative FREEWARE (for non-commercial use) graphic viewer for Windows 9x/ME/NT/2000/XP/2003/Vista. It is trying to be simple for beginners and powerful for professionals.". Secunia Research has discovered a vulnerability in IrfanView, which can be exploited by malicious people to compromise a user's system. |
| |
Credit:
The information has been provided by Secunia Research.
The original article can be found at: http://secunia.com/secunia_research/2007-71/
|
| |
Vulnerable Systems:
* IrfanView version 3.99
* IrfanView version 4.00
Immune Systems:
* IrfanView version 4.10
The vulnerability is caused due to a boundary error when importing palette (*.pal) files. This can be exploited to cause a stack-based buffer overflow by tricking a user into importing a specially crafted palette (*.pal) file.
Successful exploitation allows the execution of arbitrary code.
Time Table:
28/08/2007 - Vendor notified.
28/08/2007 - Vendor response.
16/10/2007 - Public disclosure.
CVE Information:
CVE-2007-4343
|
|
|
