Exploit code posted for critical Adobe Photoshop flaw

Summary:Photoshoppers, be careful. Publicly available exploit code for a serious security flaw in Adobe Photoshop could allow attackers to take complete control of your Windows machine.

Photoshoppers, be careful.

Publicly available exploit code for a serious security flaw in Adobe Photoshop could allow attackers to take complete control of your Windows machine, according to an advisory from FrSIRT.

Adobe logo
The flaw, rated critical, is caused by buffer overflow errors when handling a malformed "BMP", "DIB" or "RLE" file.

"[This could be exploited by attackers to take complete control of an affected system by tricking a user into opening a specially crafted file using a vulnerable application," FrSIRT said.

Affected products include Adobe Photoshop CS2 and Adobe Photoshop CS3.

The exploit code, available at  Milw0rm.com, has been successfully tested against Windows XP Service Pack 2.

Separately, an exploit for an equally serious flaw in Corel Paint Shop Pro is also in circulation.  This also puts users at risk of code execution attacks using rigged .CLP files. 

There are no patches available for these vulnerabilities.  The standard advice applies:  Be careful when opening files from untrusted sources. 

Topics: Enterprise Software

About

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content managem... Full Bio

zdnet_core.socialButton.googleLabel Contact Disclosure

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.