PT-2006-3065 · Ace+1 · Cxace60.Dll+2

Tan Chew Keong · Publicado 2006-04-29 · Atualizado 2018-10-18 · CVE-2006-2085

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SpeedProject Squeez version 5.10 Build 4460 SpeedCommander versions 10.52 Build 4450 through 11.01 Build 4450

Description The issue is related to multiple buffer overflows in the CxAce60.dll and CxAce60u.dll files. This allows user-assisted remote attackers to execute arbitrary code via an ACE archive containing a file with a long filename.

Recommendations For SpeedProject Squeez version 5.10 Build 4460, consider disabling the use of ACE archives until a patch is available. For SpeedCommander versions 10.52 Build 4450 through 11.01 Build 4450, avoid using the CxAce60.dll and CxAce60u.dll files to handle ACE archives until the issue is resolved.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2006-2085

Produtos afetados

Cxace60.Dll

Speedcommander

Speedproject Squeez

Referências · 12

• http://securityfocus.com/archive/1/432101/100/0/threaded · Nota
• http://speedproject.de/enu · Nota
• http://secunia.com/advisories/19473 · Aviso do Fabricante
• http://secunia.com/secunia_research/2006-23/advisory · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-2085 · Nota de Segurança
• http://securitytracker.com/id?1016002 · Nota
• http://vupen.com/english/advisories/2006/1535 · Aviso do Fabricante
• http://securityfocus.com/bid/17709 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26115 · Nota
• http://osvdb.org/24990 · Nota
• http://securityreason.com/securityalert/820 · Nota
• http://securitytracker.com/id?1016003 · Nota