SoftArtisans XFile FileManager ActiveX Control Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	30826
Class:	Boundary Condition Error
CVE:	CVE-2007-1682
Remote:	Yes
Local:	No
Published:	Aug 25 2008 12:00AM
Updated:	Feb 19 2010 07:21PM
Credit:	Will Dormann of CERT/CC.
Vulnerable:	SoftArtisans XFile 2.3.4 SoftArtisans XFile 2.2.3
Not Vulnerable:	SoftArtisans XFile 2.4

SoftArtisans XFile FileManager ActiveX Control Multiple Buffer Overflow Vulnerabilities

SoftArtisans XFile is prone to multiple buffer-overflow vulnerabilities because it fails to properly bounds-check user-supplied data before copying it into an insufficiently sized memory buffer.

An attacker can exploit these issues to execute arbitrary code within the context of application that invoked the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in a denial-of-service condition.

Versions prior to SoftArtisans XFile 2.4.0 are vulnerable.

SoftArtisans XFile FileManager ActiveX Control Multiple Buffer Overflow Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SoftArtisans XFile FileManager ActiveX Control Multiple Buffer Overflow Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.

SoftArtisans XFile FileManager ActiveX Control Multiple Buffer Overflow Vulnerabilities

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• Vendor Homepage (SoftArtisian)
  
• XFile Release Notes (SoftArtisian)
  
• Vulnerability Note VU#914785 (US-CERT)