SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (File Transfer/Sharing)  >   Total Commander Vendors:   Ghisler, Christian
Total Commander Buffer Overflow UNACEV2.DLL Lets Remote Users Cause Arbitrary Code to Be Executed
SecurityTracker Alert ID:  1015852
SecurityTracker URL:  http://securitytracker.com/id/1015852
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Mar 31 2006
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 6.54
Description:   A vulnerability was reported in Total Commander. A remote user can cause arbitrary code to be executed on the target user's system.

The UNACEV2.DLL component contains a buffer overflow. A remote user can create an ACE archive containing a file that has a specially crafted filename. When the target user extracts the archive, the stack overlow will be triggered and arbitrary code will be executed. The code will run with the privileges of the target user.

Tan Chew Keong of Secunia Research discovered this vulnerability in ALZip (see Alert ID 1014863). Total Commander is also affected.

Impact:   A remote user can create an archive that, when processed by the target user, will cause arbitrary code to be executed on the target user's system. The code will run with the privileges of the target user.
Solution:   The vendor has issued a fixed version (6.54), available at:

http://www.ghisler.com/download.htm

Vendor URL:  www.ghisler.com/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Windows (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC