Multiple SpeedProject Products ACE Archive Filename Handling Buffer Overflow Vulnerability
BID:17709
Info
Multiple SpeedProject Products ACE Archive Filename Handling Buffer Overflow Vulnerability
| Bugtraq ID: | 17709 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 26 2006 12:00AM |
| Updated: | Apr 26 2006 11:26PM |
| Credit: | Discovery is credited to Tan Chew Keong, Secunia Research. |
| Vulnerable: |
Speedproject Squeez 5.10 Build 4460 Speedproject SpeedCommander 11.01Build 4450 Speedproject SpeedCommander 10.52 Build 4450 |
| Not Vulnerable: |
Speedproject Squeez 5.20 Build 4600 Speedproject SpeedCommander 11.10 Build 4590 Speedproject SpeedCommander 10.53 Build 4590 |
Discussion
Multiple SpeedProject Products ACE Archive Filename Handling Buffer Overflow Vulnerability
Multiple SpeedProject products are prone to a buffer-overflow vulnerability. This issue is due to the applications' failure to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.
Attackers can exploit this vulnerability to execute arbitrary code in the context of the user who extracts a malicious archive.
Squeez version 5.10 Build 4460 and SpeedCommander versions 10.52 Build 4450 and 11.01 Build 4450 are affected by this issue; prior versions may also be affected.
Multiple SpeedProject products are prone to a buffer-overflow vulnerability. This issue is due to the applications' failure to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.
Attackers can exploit this vulnerability to execute arbitrary code in the context of the user who extracts a malicious archive.
Squeez version 5.10 Build 4460 and SpeedCommander versions 10.52 Build 4450 and 11.01 Build 4450 are affected by this issue; prior versions may also be affected.
Exploit / POC
Multiple SpeedProject Products ACE Archive Filename Handling Buffer Overflow Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution / Fix
Multiple SpeedProject Products ACE Archive Filename Handling Buffer Overflow Vulnerability
Solution:
The vendor has released updated versions of the affected packages to address this issue.
Solution:
The vendor has released updated versions of the affected packages to address this issue.
References
Multiple SpeedProject Products ACE Archive Filename Handling Buffer Overflow Vulnerability
References:
References:
- Home Page (Speedproject)
- SpeedCommander 10 Product News (SpeedProject)
- SpeedCommander 11 Product News (SpeedProject)
- SpeedCommander Homepage (SpeedProject)
- Squeez 5 Product News (SpeedProject)
- Squeez Homepage (SpeedProject)
- Secunia Research: SpeedProject Products ACE Archive Handling Buffer Overflow (Secunia Research