April 25th, 2007
Exploit code posted for critical Adobe Photoshop flaw
Photoshoppers, be careful.
Publicly available exploit code for a serious security flaw in Adobe Photoshop could allow attackers to take complete control of your Windows machine, according to an advisory from FrSIRT.
The flaw, rated critical, is caused by buffer overflow errors when handling a malformed "BMP", "DIB" or "RLE" file.
"[This could be exploited by attackers to take complete control of an affected system by tricking a user into opening a specially crafted file using a vulnerable application," FrSIRT said.
Affected products include Adobe Photoshop CS2 and Adobe Photoshop CS3.
The exploit code, available at Milw0rm.com, has been successfully tested against Windows XP Service Pack 2.
Separately, an exploit for an equally serious flaw in Corel Paint Shop Pro is also in circulation. This also puts users at risk of code execution attacks using rigged .CLP files.
There are no patches available for these vulnerabilities. The standard advice applies: Be careful when opening files from untrusted sources.
Ryan Naraine is a journalist and security evangelist at Kaspersky Lab. He manages Threatpost.com, a security news portal. Here is Ryan's full profile and disclosure of his industry affiliations.
For daily updates on Ryan's activities, follow him on Twitter.
Subscribe to Zero Day via Email alerts or RSS.
