UltraISO 9.3.6.2750 Multiple Buffer Overflow Vulnerabilities

Bugtraq ID:	41162
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 27 2010 12:00AM
Updated:	Jun 27 2010 12:00AM
Credit:	fl0 fl0w
Vulnerable:	EZB Systems UltraISO 9.3.6 .2750
Not Vulnerable:

UltraISO 9.3.6.2750 Multiple Buffer Overflow Vulnerabilities

UltraISO is prone to multiple stack-based buffer-overflow vulnerabilities because it fails to adequately bounds-check user-supplied data before copying it to an insufficiently sized memory buffer.

Successful exploits may allow an attacker to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

UltraISO 9.3.6.2750 is vulnerable; other versions may also be affected.

UltraISO 9.3.6.2750 Multiple Buffer Overflow Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting user to open a specially crafted '.mdf' or '.mds' file.

The following proof-of-concept code is available:

• /data/vulnerabilities/exploits/41162.c

UltraISO 9.3.6.2750 Multiple Buffer Overflow Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

UltraISO 9.3.6.2750 Multiple Buffer Overflow Vulnerabilities

References:

• UltraISO Homepage (EZB Systems)