Total Commander Buffer Overflow UNACEV2.DLL Lets Remote Users Cause Arbitrary Code to Be Executed
|
|
SecurityTracker Alert ID: 1015852
|
|
SecurityTracker URL: http://securitytracker.com/id?1015852
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 31 2006
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 6.54
|
Description: A vulnerability was reported in Total Commander. A remote user can cause arbitrary code to be executed on the target user's system.
The UNACEV2.DLL component contains a buffer overflow. A remote user can create an ACE archive containing a file that has a specially
crafted filename. When the target user extracts the archive, the stack overlow will be triggered and arbitrary code will be executed.
The code will run with the privileges of the target user.
Tan Chew Keong of Secunia Research discovered this vulnerability in
ALZip (see Alert ID 1014863). Total Commander is also affected.
|
Impact: A remote user can create an archive that, when processed by the target user, will cause arbitrary code to be executed on the target user's system. The code will run with the privileges of the target user.
|
Solution: The vendor has issued a fixed version (6.54), available at:
http://www.ghisler.com/download.htm
|
Vendor URL: www.ghisler.com/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (Any)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 31 Mar 2006 01:20:30 -0500
Subject: Total Commander vulnerability
|
version 6.54a
|
|
