[NT] PowerArchiver ACE and ARJ Archive Handling Buffer Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

PowerArchiver ACE and ARJ Archive Handling Buffer Overflow
------------------------------------------------------------------------

SUMMARY

" <http://www.powerarchiver.com/> PowerArchiver is an award-winning
archive utility for the Windows family that provides support for most
compressed and encoded files, as well as access to many powerful features
and tools through an easy to use interface that seamlessly integrates with
Windows Explorer."

A vulnerability within PowerArchiver allows attackers to cause the program
to execute arbitrary code with due to a buffer overflow.

DETAILS

Vulnerable Systems:
* PowerArchiver 2006 version 9.5 Beta 5
* PowerArchiver 2006 version 9.5 Beta 4
* PowerArchiver 2004 version 9.25
* PowerArchiver 2003 version 8.60
* PowerArchiver 2002 version 8.10

Immune Systems:
* PowerArchiver 2006 version 9.26

The vulnerability is caused due to a boundary error when reading the
filename of a compressed file from an ACE/ARJ archive. This can be
exploited to cause a stack-based buffer overflow when a malicious archive
containing a file with an overly long filename is opened.

Successful exploitation allows arbitrary code execution.

Disclosure Timeline:
09/09/2005 - Initial vendor notification
20/09/2005 - Vendor provided fixed version for testing
22/09/2005 - Vendor released fixed versions
23/09/2005 - Public disclosure

ADDITIONAL INFORMATION

The information has been provided by <mailto:vuln@secunia.com> Secunia
Research.
The original article can be found at:
<http://secunia.com/advisories/16713/>
http://secunia.com/advisories/16713/

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.