Executive brief
AnyBurn is a lightweight software tool used for burning, ripping, and converting disc images like ISO files. A vulnerability in version 4.3 allows a local user to crash the application by entering an extremely long text string into the image conversion fields. While this results in a service outage for the application, it does not directly expose customer data or provide remote access to the system.
Technical details
A denial of service vulnerability exists in AnyBurn 4.3 (32-bit) due to improper handling of long input strings in the 'Convert image to file format' function. A local attacker can trigger a crash by pasting a large buffer (approximately 10,000 characters) into the 'Select source image file' or 'Select Destination image file' input fields and clicking 'Convert Now'. This appears to be a classic buffer overflow leading to an application crash. While the advisory mentions CWE-226, the behavior described is consistent with a resource exhaustion or memory corruption issue. Users should update to a more recent version, as the vendor has released version 6.8.
Affected products
- Anyburn AnyBurn x86 4.3 (32-bit) and earlier
Timeline
- 2019-01-30: disclosed: Original discovery and PoC by Dino Covotsos of Telspace Systems
- 2026-04-05: advisory: NVD/VulnCheck advisory published