7-Zip Buffer Overflow in Processing ARJ Archives May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1014966
|
|
SecurityTracker URL: http://securitytracker.com/id?1014966
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Sep 23 2005
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Advisory: Secunia Research
|
Version(s): 3.13, 4.23, and 4.26 BETA
|
Description: A vulnerability was reported in 7-Zip. A remote user may be able to cause arbitrary code to be executed on the target system.
A remote user can create a specially crafted ARJ archive that, when opened by the target user, trigger a buffer overflow and execute
arbitrary code. An archive with an ARJ block larger than 2600 bytes can cause the overflow.
The vendor was notified on September
5, 2005.
Tan Chew Keong of Secunia Research discovered this vulnerability.
|
Impact: A remote user can create an archive that, when processed by the target user, will execute arbitrary code on the target user's system.
|
Solution: The vendor has issued a fixed version (4.27 BETA), available at:
http://www.7-zip.org/
|
Vendor URL: www.7-zip.org/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Windows (Any)
|
Reported By: Secunia Research <vuln@secunia.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Fri, 23 Sep 2005 10:09:19 +0200
From: Secunia Research <vuln@secunia.com>
Subject: [Full-disclosure] Secunia Research: 7-Zip ARJ Archive Handling
|
======================================================================
Secunia Research 23/09/2005
- 7-Zip ARJ Archive Handling Buffer Overflow -
======================================================================
Table of Contents
Affected Software....................................................1
Severity.............................................................2
Description of Vulnerability.........................................3
Solution.............................................................4
Time Table...........................................................5
Credits..............................................................6
References...........................................................7
About Secunia........................................................8
Verification.........................................................9
======================================================================
1) Affected Software
7-Zip Version 3.13, 4.23, and 4.26 BETA
Other versions may also be affected.
======================================================================
2) Severity
Rating: Moderately Critical
Impact: System access
Where: Remote
======================================================================
3) Description of Vulnerability
Secunia Research has discovered a vulnerability in 7-Zip, which can
be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to a boundary error when handling an
ARJ block that is larger than 2600 bytes. This can be exploited to
cause a stack-based buffer overflow when a specially crafted ARJ file
is opened.
Successful exploitation allows arbitrary code execution.
======================================================================
4) Solution
The vulnerability has been fixed in version 4.27 BETA.
======================================================================
5) Time Table
05/09/2005 - Initial vendor notification.
05/09/2005 - Initial vendor reply.
21/09/2005 - Vendor released fixed version.
23/09/2005 - Public disclosure.
======================================================================
6) Credits
Discovered by Tan Chew Keong, Secunia Research.
======================================================================
7) References
No references available.
======================================================================
8) About Secunia
Secunia collects, validates, assesses, and writes advisories regarding
all the latest software vulnerabilities disclosed to the public. These
advisories are gathered in a publicly available database at the
Secunia website:
http://secunia.com/
Secunia offers services to our customers enabling them to receive all
relevant vulnerability information to their specific system
configuration.
Secunia offers a FREE mailing list called Secunia Security Advisories:
http://secunia.com/secunia_security_advisories/
======================================================================
9) Verification
Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2005-45/advisory/
Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/
======================================================================
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
|
|
