iccDEV Stack Overflow Vulnerability Leading to Denial-of-Service

A stack overflow vulnerability has been identified in iccDEV versions prior to 2.3.1.5. The issue arises in the CIccBasicStructFactory::CreateStruct() function, where improper handling of ICC color management profiles creates uncontrolled recursion. This recursion exhausts the stack, causing a crash. The vulnerability requires user interaction to be exploited.

Impact

Exploitation of this vulnerability causes a stack overflow, leading to uncontrolled recursion, stack exhaustion, and a crash of the application.

Reproduction

The vulnerability can be reproduced by using a crafted ICC profile that triggers the recursive behavior in the CIccBasicStructFactory::CreateStruct() function. This can be done by using the 'iccDumpProfile' tool with the vulnerable ICC profile as input. The AddressSanitizer will report a stack overflow error, indicating that the vulnerability has been successfully exploited.

Remediation

Users can upgrade to iccDEV version 2.3.1.5 or later to address this vulnerability.