LHAZ LHA Long Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	19377
Class:	Boundary Condition Error
CVE:	CVE-2006-4116
Remote:	Yes
Local:	No
Published:	Jul 31 2006 12:00AM
Updated:	Jul 06 2016 01:33PM
Credit:	Tan Chew Keong is credited with the discovery of these vulnerabilities.
Vulnerable:	Lhaz Lhaz 1.3.1
Not Vulnerable:	Lhaz Lhaz 1.3.2

LHAZ LHA Long Multiple Buffer Overflow Vulnerabilities

Lhaz is prone to multiple buffer-overflow vulnerabilities because the application fails to check overly long filenames before copying them to a finite-sized buffer.

An attacker can exploit these issues to execute arbitrary code within the context of the affected application.

Version 1.31 is vulnerable to these issues; other versions may also be affected.

LHAZ LHA Long Multiple Buffer Overflow Vulnerabilities

Currently we are not aware of any exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

LHAZ LHA Long Multiple Buffer Overflow Vulnerabilities

Solution:
The vendor has released version 1.3.2 to address this issue. Please see the references for more information.

LHAZ LHA Long Multiple Buffer Overflow Vulnerabilities

References:

• Lhaz Homepage (Lhaz)
  
• [vuln.sg] Lhaz LHA Long Filename Buffer Overflow Vulnerability ([email protected])