PT-2005-4579 · Speedproject · Speedcommander+2

Publicado 2005-11-26 · Atualizado 2018-10-19 · CVE-2005-3831

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SpeedCommander versions 10.51 Build 4430 and 11.0 Build 4430 ZipStar version 5.0 Build 4285 Squeez version 5.0 Build 4285

Description The issue is a stack-based buffer overflow in certain DLL files used by SpeedProject products. This allows attackers to execute arbitrary code via a ZIP archive containing a long filename.

Recommendations For SpeedCommander versions 10.51 Build 4430 and 11.0 Build 4430, update to a version that fixes the issue in CxZIP60.dll and CxZIP60u.dll. For ZipStar version 5.0 Build 4285, update to a version that fixes the issue in CxZIP60.dll and CxZIP60u.dll. For Squeez version 5.0 Build 4285, update to a version that fixes the issue in CxZIP60.dll and CxZIP60u.dll. As a temporary workaround, consider avoiding the use of ZIP archives with long filenames in the affected products until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2005-3831

Produtos afetados

Speedcommander

Squeeze

Zipstar

Referências · 9

• http://securityfocus.com/archive/1/417588/30/0/threaded · Nota
• http://secunia.com/advisories/17420 · Aviso do Fabricante
• http://securitytracker.com/id?1015266 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2005-3831 · Nota de Segurança
• http://osvdb.org/21073 · Nota
• http://secunia.com/secunia_research/2005-60/advisory · Aviso do Fabricante
• http://securitytracker.com/id?1015265 · Aviso do Fabricante
• http://securitytracker.com/id?1015267 · Aviso do Fabricante
• http://vupen.com/english/advisories/2005/2570 · Aviso do Fabricante