NVD Vulnerability Detail

CVE-2013-4988

Summary	Stack-based buffer overflow in IcoFX 2.5 and earlier allows remote attackers to execute arbitrary code via a long idCount value in an ICONDIR structure in an ICO file. NOTE: some of these details are obtained from third party information.
Publication Date	Dec. 14, 2013, 3:07 a.m.
Registration Date	Jan. 26, 2021, 3:44 p.m.
Last Update	Nov. 21, 2024, 10:56 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://archives.neohapsis.com/archives/bugtraq/2013-12/0046.html	Exploit
2	http://archives.neohapsis.com/archives/bugtraq/2013-12/0046.html	Exploit
3	http://osvdb.org/100826
4	http://osvdb.org/100826
5	http://packetstormsecurity.com/files/124380/IcoFX-2.5.0.0-Buffer-Overflow.html	Exploit
6	http://packetstormsecurity.com/files/124380/IcoFX-2.5.0.0-Buffer-Overflow.html	Exploit
7	http://packetstormsecurity.com/files/162995/IcoFX-2.6-Buffer-Overflow.html
8	http://packetstormsecurity.com/files/162995/IcoFX-2.6-Buffer-Overflow.html
9	http://seclists.org/fulldisclosure/2013/Dec/54	Exploit
10	http://seclists.org/fulldisclosure/2013/Dec/54	Exploit
11	http://secunia.com/advisories/55964	Vendor Advisory
12	http://secunia.com/advisories/55964	Vendor Advisory
13	http://www.coresecurity.com/advisories/icofx-buffer-overflow-vulnerability	Exploit
14	http://www.coresecurity.com/advisories/icofx-buffer-overflow-vulnerability	Exploit
15	http://www.exploit-db.com/exploits/30208	Exploit
16	http://www.exploit-db.com/exploits/30208	Exploit
17	http://www.securityfocus.com/bid/64221
18	http://www.securityfocus.com/bid/64221
19	https://exchange.xforce.ibmcloud.com/vulnerabilities/89611
20	https://exchange.xforce.ibmcloud.com/vulnerabilities/89611

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html

JVN Vulnerability Information

IcoFX におけるスタックベースのバッファオーバーフローの脆弱性

Title	IcoFX におけるスタックベースのバッファオーバーフローの脆弱性
Summary	IcoFX には、スタックベースのバッファオーバーフローの脆弱性が存在します。
Possible impacts	第三者により、ICO ファイル内の ICONDIR 構造内の過度に長い idCount 値を介して、任意のコードを実行される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Dec. 10, 2013, midnight
Registration Date	Dec. 16, 2013, 7:41 p.m.
Last Update	Dec. 16, 2013, 7:41 p.m.

Affected System

IcoFX

IcoFX 2.5 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-4988	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4988
National Vulnerability Database (NVD)
2	CVE-2013-4988	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4988

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html

ベンダー情報

No	Name	URL
IcoFX
1	Top Page	http://icofx.ro/

その他

No	Name	URL
関連文書
1	IcoFX Buffer Overflow Vulnerability	http://www.coresecurity.com/advisories/icofx-buffer-overflow-vulnerability

Change Log

No	Changed Details	Date of change
0	[2013年12月16日] 掲載	Feb. 17, 2018, 10:37 a.m.