AOH :: HP Unsorted P :: BX1184.HTM

pdflib long filename multiple bufferoverflows



pdflib long filename multiple bufferoverflows
pdflib long filename multiple bufferoverflows



hi,
pdflib, a library for generating PDF on the fly, avilable at http:// 
www.pdflib.com, is vulnerable to multiple bufferoverflows due to a 
misuse of strcpy().
An attacker can exploit this issue to execute arbitrary code or to  
crash the application that uses the library.
One of the vulnerable functions is pdc_fsearch_fopen() that is  
called, for example, by PDF_load_image() which overflows a stack  
buffer if a long filename is provided.
The php wrapper for pdflib (pecl extension) is also vulnerable so  
please take care of allowing users to generate custom pdfs from webapps.

this is a proof-of-concept that crashes php:



The developers have been warned and they plained to fix those bugs in  
the next release.


cheers,
-poplix
http://px.dynalias.org 



The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.