[Full-disclosure] Secunia Research: ZipGenius Multiple Archive Handling Buffer Overflow

From: Secunia Research (vuln_at_secunia.com)
Date: 10/21/05

  • Next message: Luigi Auriemma: "[Full-disclosure] F.E.A.R. 1.01 likes lithsock" 
    To: full-disclosure@lists.grok.org.uk
Date: Fri, 21 Oct 2005 15:34:25 +0200

    ======================================================================

                         Secunia Research 21/10/2005

           - ZipGenius Multiple Archive Handling Buffer Overflow -

    ======================================================================
    Table of Contents

    Affected Software....................................................1
    Severity.............................................................2
    Description of Vulnerability.........................................3
    Solution.............................................................4
    Time Table...........................................................5
    Credits..............................................................6
    References...........................................................7
    About Secunia........................................................8
    Verification.........................................................9

    ======================================================================
    1) Affected Software

    ZipGenius Version 5.5.1.468 and 6.0.2.1041.

    Prior versions may also be affected.

    ======================================================================
    2) Severity

    Rating: Moderately Critical
    Impact: System access
    Where: Remote

    ======================================================================
    3) Description of Vulnerability

    Secunia Research has discovered some vulnerabilities in ZipGenius,
    which can be exploited by malicious people to compromise a user's
    system.

    1) A boundary error exists in "zipgenius.exe", "zg.exe", "zgtips.dll",
    and "contmenu.dll" when reading the filename of a compressed file
    from a ZIP archive. This can be exploited to cause a stack-based
    buffer overflow when a malicious archive containing a file with an
    overly long filename is read either in ZipGenius or from Windows
    Explorer.

    2) A boundary error exists in "zipgenius.exe" when handling the
    original name of a UUE/XXE/MIM encoded file. This can be exploited
    to cause a stack-based buffer overflow when a malicious UUE/XXE/MIM
    archive containing an encoded file with an overly long filename is
    opened.

    3) A boundary error exists in "unacev2.dll" when extracting an ACE
    archive containing a file with an overly long filename. This can be
    exploited to cause a stack-based buffer overflow when a malicious
    ACE archive is extracted using "zipgenius.exe" or "zg.exe".

    Vulnerability #3 is related to:
    SA14359

    ======================================================================
    4) Solution

    Update to version 6.0.2.1050.

    ======================================================================
    5) Time Table

    04/10/2005 - Initial vendor notification.
    05/10/2005 - Initial vendor reply.
    20/10/2005 - Vendor released fixed version.
    21/10/2005 - Public disclosure.

    ======================================================================
    6) Credits

    Discovered by Tan Chew Keong, Secunia Research.

    ======================================================================
    7) References

    ZipGenius:
    http://forum.zipgenius.it/index.php?showtopic=684

    ======================================================================
    8) About Secunia

    Secunia collects, validates, assesses, and writes advisories regarding
    all the latest software vulnerabilities disclosed to the public. These
    advisories are gathered in a publicly available database at the
    Secunia website:

    http://secunia.com/

    Secunia offers services to our customers enabling them to receive all
    relevant vulnerability information to their specific system
    configuration.

    Secunia offers a FREE mailing list called Secunia Security Advisories:

    http://secunia.com/secunia_security_advisories/

    ======================================================================
    9) Verification

    Please verify this advisory by visiting the Secunia website:
    http://secunia.com/secunia_research/2005-54/advisory/

    Complete list of vulnerability reports published by Secunia Research:
    http://secunia.com/secunia_research/

    ======================================================================

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Luigi Auriemma: "[Full-disclosure] F.E.A.R. 1.01 likes lithsock"

    Relevant Pages