CVE-2024-45871
📋 TL;DR
BandiView 7.05 contains an incorrect access control vulnerability in the sub_0x232bd8 function that allows attackers to cause denial of service. This affects all users running the vulnerable version of Bandisoft's BandiView image viewer software. Attackers can crash the application by exploiting this flaw.
💻 Affected Systems
- Bandisoft BandiView
📦 What is this software?
Bandiview by Bandisoft
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash and denial of service, potentially disrupting image viewing workflows and causing data loss if files are being processed.
Likely Case
Application crash requiring restart, temporary disruption to user's ability to view images with BandiView.
If Mitigated
Minimal impact if application is not processing critical files or if alternative viewers are available.
🎯 Exploit Status
Proof of concept available on GitHub demonstrates the denial of service attack. Exploitation appears straightforward based on the available information.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check Bandisoft website for updated version. If available, download and install the latest version of BandiView.
🔧 Temporary Workarounds
Use alternative image viewer
windowsTemporarily use a different image viewing application until BandiView is patched.
Restrict file access
windowsLimit BandiView's access to untrusted files and network shares.
🧯 If You Can't Patch
- Monitor for application crashes and investigate suspicious files that trigger them
- Implement application whitelisting to control which applications can run
🔍 How to Verify
Check if Vulnerable:
Check BandiView version in Help > About. If version is 7.05, the system is vulnerable.Check Version:
Not applicable - check via BandiView GUI Help > About menuVerify Fix Applied:
Update to a version later than 7.05 and verify the version in Help > About.📡 Detection & Monitoring
Log Indicators:
- Application crash logs for BandiView
- Windows Event Logs showing application failures
Network Indicators:
- Unusual network shares or file transfers targeting BandiView users
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="BandiView.exe"