ALTools ALZip Multiple Archive Formats File Name Buffer Overflow Vulnerability

Bugtraq ID:	15010
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 05 2005 12:00AM
Updated:	Oct 05 2005 12:00AM
Credit:	Discovery is credited to Tan Chew Keong, Secunia Research.
Vulnerable:	ALTools ALZip 6.12 (Korean) ALTools ALZip 6.1 ALTools ALZip 5.52
Not Vulnerable:	ALTools ALZip 6.13

ALTools ALZip Multiple Archive Formats File Name Buffer Overflow Vulnerability

ALZip is prone to a buffer overflow when handling various archive formats.

Long file names can be copied into a finite stack-based buffer without adequate limitations on the size of the source data resulting in corruption of adjacent regions of stack-based memory.

This issue could be exploited to execute arbitrary code facilitating a remote compromise.

ALTools ALZip Multiple Archive Formats File Name Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ALTools ALZip Multiple Archive Formats File Name Buffer Overflow Vulnerability

Solution:
The vendor has released ALZip version 6.13 to address this issue. Please contact the vendor to obtain the fixed version.

ALTools ALZip Multiple Archive Formats File Name Buffer Overflow Vulnerability

References:

• ALTools Homepage (ALTools)
  
• Secunia Research: ALZip Multiple Archive Handling Buffer Overflow (Secunia Research )