PT-2023-5667 · Accusoft · Accusoft Imagegear

Emmanuel Tacheau · Published 2023-09-25 · Updated 2023-09-25 · CVE-2023-28393

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Accusoft ImageGear version 20.1

Description A stack-based buffer overflow vulnerability exists in the tif processing dng channel count functionality. This issue is related to a buffer overflow operation. Exploitation of this vulnerability may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. A specially crafted malformed file can lead to memory corruption, and an attacker can provide a malicious file to trigger this vulnerability.

Recommendations For Accusoft ImageGear version 20.1, consider disabling the tif processing dng channel count function until a patch is available to prevent potential exploitation. Restrict access to handling malformed files to minimize the risk of triggering the buffer overflow.

Exploit

Fix

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

BDU:2023-06334

CVE-2023-28393

Affected Products

Accusoft Imagegear

References · 9

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2023-1742 · Exploit
• https://osv.dev/vulnerability/CVE-2023-28393 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28393 · Security Note
• https://bdu.fstec.ru/vul/2023-06334 · Security Note
• https://help.accusoft.com/ImageGear/v20.3/Windows/DLL/webframe.html#release-notes.html · Note
• https://help.accusoft.com/ImageGear/v20.3/Linux/webframe.html#release-notes.html · Note
• https://vuldb.com/?id.240308 · Note
• https://twitter.com/VulmonFeeds/status/1706379068386467861 · Twitter Post
• https://twitter.com/cracbot/status/1706549238312972529 · Twitter Post