[NT] PowerArchiver ACE and ARJ Archive Handling Buffer Overflow

From: SecuriTeam (support_at_securiteam.com)
Date: 09/29/05

  • Next message: SecuriTeam: "[EXPL] Barracuda Spam Firewall img.pl Command Execution (Exploit)" 
    To: list@securiteam.com
Date: 29 Sep 2005 10:53:51 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      PowerArchiver ACE and ARJ Archive Handling Buffer Overflow
    ------------------------------------------------------------------------

    SUMMARY

    " <http://www.powerarchiver.com/> PowerArchiver is an award-winning
    archive utility for the Windows family that provides support for most
    compressed and encoded files, as well as access to many powerful features
    and tools through an easy to use interface that seamlessly integrates with
    Windows Explorer."

    A vulnerability within PowerArchiver allows attackers to cause the program
    to execute arbitrary code with due to a buffer overflow.

    DETAILS

    Vulnerable Systems:
     * PowerArchiver 2006 version 9.5 Beta 5
     * PowerArchiver 2006 version 9.5 Beta 4
     * PowerArchiver 2004 version 9.25
     * PowerArchiver 2003 version 8.60
     * PowerArchiver 2002 version 8.10

    Immune Systems:
     * PowerArchiver 2006 version 9.26

    The vulnerability is caused due to a boundary error when reading the
    filename of a compressed file from an ACE/ARJ archive. This can be
    exploited to cause a stack-based buffer overflow when a malicious archive
    containing a file with an overly long filename is opened.

    Successful exploitation allows arbitrary code execution.

    Disclosure Timeline:
    09/09/2005 - Initial vendor notification
    20/09/2005 - Vendor provided fixed version for testing
    22/09/2005 - Vendor released fixed versions
    23/09/2005 - Public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:vuln@secunia.com> Secunia
    Research.
    The original article can be found at:
    <http://secunia.com/advisories/16713/>
    http://secunia.com/advisories/16713/

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] Barracuda Spam Firewall img.pl Command Execution (Exploit)"

    Relevant Pages