Compression Plus and Tumblweed EMF Stack Overflow Aug 31 2006 07:16PM
Michael Hale Ligh (michael ligh mnin org)
The Compression Plus library is designed to handle de/compression of
popular archiving formats such as ARC, ARK, PAK, ARJ, CAB, GZ, LBR, TAR,
TAZ, TGZ, Z, ZIP, and ZOO. The code fails to properly validate input
while processing specially crafted ZOO files, which results in a
stack-based buffer overflow. Software products that implement the
Compression Plus library are vulnerable to local or remote code
execution, depending on the nature of the calling process.

Details are available from the following URL:

http://www.mnin.org/advisories/2006_cp5_tweed.pdf

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus