nSense-2011-001: VeryPDF pdf2tif

   nSense Vulnerability Research Security Advisory NSENSE-2011-001
   ---------------------------------------------------------------

   Affected Vendor:    VeryPDF (+ Multiple others, eg
                       Barcode Reader Tookit version 7.4.1.3 )
   Affected Product:   PDF Extract TIFF COM (prior to April 8'th)
   Platform:           Windows
   Impact:             Local/Remote code execution
   Vendor response:    Patch
   CVE:                None
   CVSS2:              9.3 - (AV:N/AC:M/Au:N/C:C/I:C/A:C)
   Credit:             JODE

   Technical details
   ---------------------------------------------------------------

   A PDF file format parsing vulnerability exists in the pdf2tif
   parser and can be exploited with a specially crafted input
   file. The plugin suffers from a buffer overflow flaw.

   Many server side applications use the library when converting
   pdf files to images. If an attacker is able to send the
   application a malicious file, successful exploitation leads to
   code being executed in  the context of the running application.

   Solution
   Upgrade to the latest version of the pdf2tif.dll.

   Timeline:
   April    1th                  Contacted vendor
   April    1th                  Vendor responded, requesting gold
                                 support license agreement number.
   April    8th                  Vendor released the fix
   April    12th                 Advisory released

   Links:
   http://www.nsense.fi                       http://www.nsense.dk



   $$s$$$$s.   ,s$$$$s   ,S$$$$$s.  $$s$$$$s.   ,s$$$$s   ,S$$$$$s.
   $$$  `$$$  ($$(       $$$  `$$$  $$$  `$$$  ($$(       $$$  `$$$
   $$$   $$$    `^$$s.   $$$$$$$$$  $$$   $$$    `^$$s.   $$$$$$$$$
   $$$   $$$       )$$)  $$$        $$$   $$$       )$$)  $$$
   $$$   $$$  ^$$$$$$7    `7$$$$$P  $$$   $$$  ^$$$$$$7   `7$$$$$P

                  D r i v e n   b y   t h e   c h a l l e n g e _