Secunia Security Advisory - Secunia Research has discovered a vulnerability in PowerArchiver, which can be exploited by malicious people to compromise a user's system.
32967ac293fb4e10b11ee4bd97e6f40ac54e49efdd282623099ceeeeb3c168b5
----------------------------------------------------------------------
Bist Du interessiert an einem neuen Job in IT-Sicherheit?
Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
http://secunia.com/secunia_vacancies/
----------------------------------------------------------------------
TITLE:
PowerArchiver ACE/ARJ Archive Handling Buffer Overflow
SECUNIA ADVISORY ID:
SA16713
VERIFY ADVISORY:
http://secunia.com/advisories/16713/
CRITICAL:
Moderately critical
IMPACT:
System access
WHERE:
>From remote
SOFTWARE:
PowerArchiver 2003 8.x
http://secunia.com/product/2202/
PowerArchiver 2002 8.x
http://secunia.com/product/2201/
PowerArchiver 2004 9.x
http://secunia.com/product/5756/
DESCRIPTION:
Secunia Research has discovered a vulnerability in PowerArchiver,
which can be exploited by malicious people to compromise a user's
system.
The vulnerability is caused due to a boundary error when reading the
filename of a compressed file from an ACE/ARJ archive. This can be
exploited to cause a stack-based buffer overflow when a malicious
archive containing a file with an overly long filename is opened.
Successful exploitation allows arbitrary code execution.
The vulnerability has been confirmed in the following versions with
ACE, or ARJ archives, or both:
* PowerArchiver 2006 version 9.5 Beta 4/Beta 5
* PowerArchiver 2004 version 9.25
* PowerArchiver 2003 version 8.60
* PowerArchiver 2002 version 8.10
Prior versions may also be affected.
SOLUTION:
Update to a fixed version.
PowerArchiver 2004:
Update to version 9.26.
The vulnerability has also been fixed in PowerArchiver 2006 Beta 6.
PROVIDED AND/OR DISCOVERED BY:
Tan Chew Keong, Secunia Research.
ORIGINAL ADVISORY:
Secunia Research:
http://secunia.com/secunia_research/2005-50/advisory/
----------------------------------------------------------------------
About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.
Subscribe:
http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/
Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.
----------------------------------------------------------------------