Winace UnAce Command Line Argument Buffer Overflow Vulnerability

Bugtraq ID:	9002
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 10 2003 12:00AM
Updated:	Nov 10 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Andreas Constantinides <[email protected]>.
Vulnerable:	Winace UnAce 2.2
Not Vulnerable:

Winace UnAce Command Line Argument Buffer Overflow Vulnerability

UnAce has been reported to be prone to a buffer overflow vulnerability. The issue presents itself when UnAce handles ace filenames that are of excessive length. When this filename is passed to the UnAce utility as an argument, the string is copied into a reserved buffer in memory. Data that exceeds the size of the reserved buffer will overflow its bounds and will trample any saved data that is adjacent to the affected buffer. Ultimately this may lead to the execution of arbitrary instructions in the context of the user who is running UnAce.

Winace UnAce Command Line Argument Buffer Overflow Vulnerability

The following proof of concept has been supplied:
[root@megahz root]# ./unace e aaaaaa(a*600).ace

UNACE v2.2 Copyright by ACE Compression Software May 9 2002
10:59:42
Segmentation fault
[root@megahz root]#

• /data/vulnerabilities/exploits/gEEk-unace.c
• /data/vulnerabilities/exploits/unace-exp.c

Winace UnAce Command Line Argument Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.