Signature Detail
Short Name |
HTTP:STC:ACTIVEX:LEADTOOLS-JPEG |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
HTTP |
Keywords |
LEADTOOLS JPEG2000 Unsafe ActiveX Control |
Release Date |
2012/11/05 |
Update Number |
2200 |
Supported Platforms |
idp-4.0.110090709+, isg-3.1.134269+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: LEADTOOLS JPEG2000 Unsafe ActiveX Control
This signature detects attempts to exploit a known flaw in LEADTOOLS JPEG2000 ActiveX control, which is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. Successfully exploiting this issue allows remote attackers to execute arbitrary code with the privileges of the browsing process.
Extended Description
LEADTOOLS JPEG2000 ActiveX control is prone to a buffer-overflow vulnerability because the application fails to bounds-check user-supplied data before copying it into an insufficiently sized buffer. Successfully exploiting this issue allows remote attackers to execute arbitrary code in the context of the application using the ActiveX control (typically Internet Explorer). Failed exploit attempts likely result in denial-of-service conditions. LEADTOOLS JPEG2000 ActiveX control 14.5.0.35 is vulnerable; other versions may also be affected.
Affected Products
- LeadTools JPEG 2000 14.5.0.35
References
- BugTraq: 24040
- CVE: CVE-2007-2771