PT-2007-4159 · Dart · Dart Ziplite Compression For Activex

Shinnai · Published 2007-05-24 · Updated 2017-07-29 · CVE-2007-2855

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dart ZipLite Compression for ActiveX version 1.8.5.3

Description The issue is related to a buffer overflow in a certain ActiveX control in DartZipLite.dll, which allows user-assisted remote attackers to execute arbitrary code. This is achieved by providing a long first argument to the QuickZip function.

Recommendations For version 1.8.5.3, consider disabling the QuickZip function as a temporary workaround until a patch is available. Restrict access to the DartZipLite.dll module to minimize the risk of exploitation. Avoid using long arguments in the QuickZip function until the issue is resolved.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-2855

Affected Products

Dart Ziplite Compression For Activex

References · 5

• 🔥 http://shinnai.altervista.org/viewtopic.php?id=42&t_id=25 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-2855 · Security Note
• http://osvdb.org/38110 · Note
• http://moaxb.blogspot.com/2007/05/moaxb-22-bonus-dart-ziplite-compression.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34433 · Note