Title: 2Fax Tab Expansion Buffer Overflow Vulnerability
Severity: HIGH
Description:
2fax is a text to tiff conversion application. It is available for UNIX/Linux variants as well as Windows platforms.
2fax is prone to a buffer overflow vulnerability. This issue is exposed when the software performs tab expansion operations while converting files. Since files may originate from an external or untrusted source, this issue is considered remote in nature.
The specific vulnerability exists in the expandtabs() functions in '2fax.c'. When this function reads data from a text file, it will copy the data into a 256 byte destination buffer. If the data is too large for the destination buffer, memory corruption will occur.
Successful exploitation will result in execution of arbitrary code in the context of the user running the application.
Affected Products:
- 2fax 2fax 3.0.04
References:
- "D. J. Bernstein" <djb@cr.yp.to>: [remote] [control] 2fax 3.04 expandtabs overflows s buffer
- "Hans Harder" <hans@atbas.org>: Re: [remote] [control] 2fax 3.04 expandtabs overflows s buffer
- 2fax: 2fax Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
