010 Editor File Parsing Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	34662
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 22 2009 12:00AM
Updated:	Apr 24 2009 06:56PM
Credit:	Le Duc Anh, Bkis
Vulnerable:	SweetScape Software 010 Editor 3.0.4
Not Vulnerable:	SweetScape Software 010 Editor 3.0.5

010 Editor File Parsing Multiple Buffer Overflow Vulnerabilities

010 Editor is prone to multiple buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied input.

Successfully exploiting these issues may allow remote attackers to execute arbitrary code in the context of the application. Failed exploit attempts will cause denial-of-service conditions.

UPDATE (April 22, 2009): Since script files and templates may include script code used to automate editor functions, the privilege gained by a successful exploit is disputed. Please see the references for more information. We will update this BID as more information emerges.

Versions prior to 010 Editor 3.0.5 are vulnerable.

010 Editor File Parsing Multiple Buffer Overflow Vulnerabilities

Proof-of-concept files are available in a zip archive:

• /data/vulnerabilities/exploits/34662.zip

010 Editor File Parsing Multiple Buffer Overflow Vulnerabilities

Solution:
Vendor updates are available. Please see the references for details.


SweetScape Software 010 Editor 3.0.4

• SweetScape Software 010EditorInstaller.exe
  http://www.sweetscape.com/download/010EditorInstaller.exe

010 Editor File Parsing Multiple Buffer Overflow Vulnerabilities

References:

• 010 Editor - Release Notes (010 Editor)
  
• 010 Editor Homepage (SweetScape Software)
  
• 010 Editor Multiple Buffer Overflow Vulnerabilities (Bkis Security Advisories)
  
• [Bkis-07-2009] 010 Editor Multiple Buffer Overflow Vulnerabilities (Bkis )
  
• Re: [Bkis-07-2009] 010 Editor Multiple Buffer Overflow Vulnerabilities (Tavis Ormandy )