FUNDUC Search and Replace Malformed ZIP File Remote Buffer Overflow Vulnerability

Bugtraq ID:	12342
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 24 2005 12:00AM
Updated:	Jan 24 2005 12:00AM
Credit:	Discovery is credited to AtmacaSoft.
Vulnerable:	FUNDUC Search and Replace 5.0
Not Vulnerable:

FUNDUC Search and Replace Malformed ZIP File Remote Buffer Overflow Vulnerability

Search and Replace is reported prone to a remote buffer overflow vulnerability. This issue may allow a remote attacker to execute arbitrary code on a vulnerable computer to gain unauthorized access.

This vulnerability arises when the application handles malformed ZIP files.

A successful attack may facilitate unauthorized access to the affected computer.

Search and Replace 5.0 and prior versions are reported vulnerable to this issue.

FUNDUC Search and Replace Malformed ZIP File Remote Buffer Overflow Vulnerability

Exploit code from AtmacaSoft is available:

• /data/vulnerabilities/exploits/searchnreplace.c

FUNDUC Search and Replace Malformed ZIP File Remote Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

FUNDUC Search and Replace Malformed ZIP File Remote Buffer Overflow Vulnerability

References:

• Search and Replace Compressed File search Local Buffer Overflow Exploit (AtmacaSoft)
  
• Search and Replace Product Page (FUNDUC)