SonicWall Security Center
Share: Linkedin Share Facebook Like
Back to SonicALERT


Adobe Photoshop ABR BO (May 28, 2010)



Description


Adobe Photoshop is a multi-platform graphics editor developed and published by Adobe Systems. Adobe Photoshop is capable of handling numerous types of image file formats. One of the formats it can handle is ABR. ABR is a proprietary file format which describes Adobe Photoshop brushes. An ABR file contains multiple structures describing a Photoshop brush. One of the structures contained is BrshObjc which contains the description of a brush stored in the following format:
Size Name Field
-------------------------------------------------
12 bytes DmtrUntF Diameter
12 bytes HrdnUntF Hardness
12 bytes AnglUntF Angle
12 bytes RndnUntF Roundness
12 bytes SpcnUntF Spacing
4 bytes Intrbool Interface
4 bytes flipXbool flipX
4 bytes flipYbool flipY
A buffer overflow vulnerability exists in Adobe Photoshop. The vulnerability is due to insufficient validation of the size of the AnglUntF structure. The vulnerable code uses the size value supplied in the Ang1UntF field as a parameter to the strncpy function. The vulnerable code will copy the specified number of bytes into a statically allocated heap buffer. This vulnerability can be exploited via numerous other file types that contain a brush definition.

In order to exploit this vulnerability remotely, an attacker must entice the target user to download and view a malicious file. Successful exploitation will result in a buffer overflow which may lead to process flow diversion within the context of the currently logged in user. In situations where code execution is not successful, the vulnerable application may terminate abnormally.

SonicWall has released an IPS signature to address a specific exploit targeting this vulnerability. The following signature has been released:
  • 5552 - Adobe Photoshop CS4 ABR File BO PoC
The vendor has released an advisory regarding this issue. The vulnerability has been assigned CVE-2010-1296 by mitre.


Back to top

Back to SonicALERT

Follow: Follow us on Facebook Follow us on Twitter Join the Conversation
#SonicWall
© 2019 SonicWall | Privacy Policy | Conditions for use | Feedback | Live Demo | SonicALERT | Document Library | Report Issues
Version: 14.8 | S2MSW04