IrfanView JPEG-2000 Plugin Remote Stack-based Buffer Overflow

medium Nessus Plugin ID 59846

Language:

Synopsis

The remote host has an application installed that is affected by a stack-based buffer overflow vulnerability.

Description

The version of the IrfanView JPEG-2000 plugin (JPEG2000.dll) was found to be less than 4.33. Such versions are affected by a stack-based buffer overflow vulnerability that can be triggered by tricking users into opening a .JP2 file with a specially crafted Quantization Default section. Successful exploitation may allow arbitrary code to be executed on the affected host subject to the privileges of the user.

Solution

Upgrade the JPEG-2000 plugin to version 4.3.3.0 (4.33) or higher.

Plugin Details

Severity: Medium

ID: 59846

File Name: irfanview_jpeg2000_stack_overflow.nasl

Version: 1.12

Type: local

Agent: windows

Family: Windows

Published: 7/5/2012

Updated: 11/15/2018

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: cpe:/a:irfanview:irfanview

Required KB Items: SMB/IrfanView/Version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/28/2012

Vulnerability Publication Date: 1/16/2012

Exploitable With

Core Impact

Metasploit (Irfanview JPEG2000 jp2 Stack Buffer Overflow)

Reference Information

CVE: CVE-2012-0897

BID: 51426

Detections

Analytics