Lhaplus LZH Archive Processing Unspecified Remote Buffer Overflow Vulnerability

Bugtraq ID:	26531
Class:	Boundary Condition Error
CVE:	CVE-2007-6175
Remote:	Yes
Local:	No
Published:	Nov 22 2007 12:00AM
Updated:	Dec 18 2007 08:05PM
Credit:	JVN reported this issue.
Vulnerable:	Lhaplus Lhaplus 1.55
Not Vulnerable:	Lhaplus Lhaplus 1.56

Lhaplus LZH Archive Processing Unspecified Remote Buffer Overflow Vulnerability

Lhaplus is prone to an unspecified remote buffer-overflow vulnerability when handling LZH archives.

Exploiting this issue may allow attackers to corrupt memory and execute arbitrary machine code in the context of users running the affected application.

This issue affects Lhaplus 1.55 and prior versions.

Lhaplus LZH Archive Processing Unspecified Remote Buffer Overflow Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Lhaplus LZH Archive Processing Unspecified Remote Buffer Overflow Vulnerability

Solution:
The vendor has released Lhaplus 1.56 to address this issue. Please see the references for more information.


Lhaplus Lhaplus 1.55

• Lhaplus lpls156.exe
  http://www7a.biglobe.ne.jp/~schezo/lpls156.exe

Lhaplus LZH Archive Processing Unspecified Remote Buffer Overflow Vulnerability

References:

• Lhaplus Advisory (Lhaplus)
  
• Vendor Homepage (Lhaplus)
  
• JVN#82610488 (JVN)