Trident Software PowerZip ZIP Archive Handling Buffer Overflow Vulnerability

Bugtraq ID:	19671
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 23 2006 12:00AM
Updated:	Aug 30 2006 10:58PM
Credit:	Discovered by Tan Chew Keong.
Vulnerable:	Trident Software PowerZip 7.06 Build 3895
Not Vulnerable:	Trident Software PowerZip 7.07 Build 3901

Trident Software PowerZip ZIP Archive Handling Buffer Overflow Vulnerability

PowerZip is prone to a remote buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input before copying it to an insufficiently sized memory buffer.

This vulnerability allows attackers to execute arbitrary machine code in the context of the affected application.

Versions of PowerZip prior to 7.07 Build 3901 are vulnerable to this issue.

Trident Software PowerZip ZIP Archive Handling Buffer Overflow Vulnerability

The researcher responsible for discovering this issue has developed an exploit for this issue. This exploit is not publicly available.

Trident Software PowerZip ZIP Archive Handling Buffer Overflow Vulnerability

Solution:
The vendor has released version 7.07 Build 3901 to address this issue.


Trident Software PowerZip 7.06 Build 3895

• Trident Software PowerZip 7.07 Build 3901
  http://www.powerzip.biz/download.aspx

Trident Software PowerZip ZIP Archive Handling Buffer Overflow Vulnerability

References:

• PowerZip Home Page (Trident Software)
  
• PowerZip Long Filename Handling Buffer Overflow Vulnerability (Tan Chew Keong)