HTTP: JPEG Underrun

This anomaly triggers when a malformed JPEG file is detected with a marker header size of 0 or 1. Microsoft Internet Explorer is vulnerable. Attackers can craft a malicious JPEG file that, when viewed in an IE Web browser, enables attackers to remotely execute arbitrary code, with user privileges on the IE user's computer or create a denial-of-service condition.

Extended Description

Microsoft (Graphics Device Interface) GDI+ JPEG handler is reported prone to an integer underflow vulnerability when handling JPEG format images. This issue presents itself due to a lack of sufficient sanity checks performed on certain JPEG data before this data employed as a bounds value for a memory copy operation. A specially crafted JPEG image may trigger this vulnerability and result in the execution of arbitrary attacker-supplied code. Code execution would occur in the context of the user who is running the vulnerable software. **Update: This issue is similar in nature to BID 1503, discovered by Solar Designer. ** An exploit that opens a command shell on the local vulnerable system as soon as the image is viewed has been released. Symantec has confirmed that this exploit code is functional. It is important to note that this exploit could potentially be modified to execute other code on the system. Administrators should remain vigilant and patch all vulnerable systems.

Affected Products

Avaya s3400_message_application_server,Microsoft outlook_2002

References

BugTraq: 11173

CVE: CVE-2017-16392

URL: http://oval.mitre.org/oval/definitions/data/oval3082.html http://www.microsoft.com/technet/security/bulletin/MS04-028.mspx http://www.us-cert.gov/cas/techalerts/TA04-260A.html

Short Name

HTTP:STC:IMG:JPEG-UNDERRUN

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: JPEG Underrun

Extended Description

Affected Products

References

Found a potential security threat?