Back to list
pdflib long filename multiple bufferoverflows
Dec 22 2007 11:01PM
poplix (poplix papuasia org)
pdflib, a library for generating PDF on the fly, avilable at http://
www.pdflib.com, is vulnerable to multiple bufferoverflows due to a
misuse of strcpy().
An attacker can exploit this issue to execute arbitrary code or to
crash the application that uses the library.
One of the vulnerable functions is pdc_fsearch_fopen() that is
called, for example, by PDF_load_image() which overflows a stack
buffer if a long filename is provided.
The php wrapper for pdflib (pecl extension) is also vulnerable so
please take care of allowing users to generate custom pdfs from webapps.
this is a proof-of-concept that crashes php:
The developers have been warned and they plained to fix those bugs in
the next release.
[ reply ]
Copyright 2010, SecurityFocus