PT-2005-4128 · Zipgenius · Zipgenius

Tan Chew Keong · Published 2005-10-27 · Updated 2009-03-25 · CVE-2005-3317

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ZipGenius versions 5.5.1.468 through 6.0.2.1041

Description The issue allows remote attackers to execute arbitrary code via multiple stack-based buffer overflows. This can occur through a ZIP archive with a file that has a long filename, which is not properly handled by various components, including zipgenius.exe, zg.exe, zgtips.dll, and contmenu.dll. Additionally, a long original name in a UUE, XXE, or MIM file can be exploited, as well as an ACE archive with a file that has a long filename, which is not properly handled by unacev2.dll.

Recommendations For versions 5.5.1.468 through 6.0.2.1041, update to version 6.0.2.1050 or later to resolve the issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2005-3317

Affected Products

Zipgenius

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2005-3317 · Security Note
• http://secunia.com/advisories/17061 · Note
• http://secunia.com/secunia_research/2005-54/advisory · Note
• http://osvdb.org/20157 · Note
• http://securityfocus.com/bid/15161 · Note
• http://forum.zipgenius.it/index.php?showtopic=684 · Note
• http://securitytracker.com/id?1015090 · Note
• http://securityfocus.com/archive/1/414083 · Note
• http://securityreason.com/securityalert/103 · Note
• http://osvdb.org/20158 · Note
• http://osvdb.org/20159 · Note