[NT] dtSearch DUNZIP32.dll Buffer Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



dtSearch DUNZIP32.dll Buffer Overflow
------------------------------------------------------------------------


SUMMARY

"The <http://www.dtsearch.com/> dtSearch product line can instantly
search terabytes of text across a desktop, network, Internet or Intranet
site."

dtSearch has been found to be affected by a buffer overflow vulnerability
due to its use of a third-party DLL called DUNZIP32.dll.

DETAILS

Vulnerable Systems:
* dtSearch Desktop with Spider version 7.10 (Build 7045).
* dtSearch 6.5 Build 6608 and prior
* dunzip32.dll Build 5.00.03 and prior

dtSearch document search system is confirmed as affected to remote type
buffer overflow vulnerability.
The vulnerability is caused due to a boundary error in a 3rd-party
compression library's (DUNZIP32.dll) remarkable old, vulnerable version
used when handling packed .ZIP documents. InnerMedia DynaZip compression
library mentioned is responsible for indexing and displaying operations.

This can be exploited to cause a buffer overflow via a specially crafted
zipped document. When a specially crafted .zip document containing a file
with an overly long filename (a file name or files inside a ZIP) is
opened, the application will crash and the attacker may be able to execute
arbitrary code on user's system.

Vendor Status:
Vendor has issued a patch shipped with immune library version 5.00.07.

It can be obtained by downloading a patch from:
<http://www.dtsearch.com/download.html#upgrades>
http://www.dtsearch.com/download.html#upgrades

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1094>
CVE-2004-1094

Disclosure Timeline:
12-Oct-2005 - Vulnerability researched and confirmed
05-Nov-2005 - Vendor was contacted
05-Nov-2005 - Vendor's reply, vendor informed about upcoming, fixed
version and timeline
06-Nov-2005 - Vendor issues a patch, detailed research
20-Dec-2005 - CVE information submission sent to Mitre.org
20-Dec-2005 - Mitre.org assigns CVE-2004-1094
21-Dec-2005 - Security companies and several CERT units contacted
23-Dec-2005 - Public disclosure


ADDITIONAL INFORMATION

The information has been provided by <mailto:juha-matti.laurio@xxxxxxxx>
Juha-Matti Laurio .
The original article can be found at:
<http://www.networksecurity.fi/advisories/dtsearch.html>
http://www.networksecurity.fi/advisories/dtsearch.html



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages