JVNDB-2007-000822

WinAce buffer overflow vulnerability

WinAce provided by e-merge GmbH is vulnerable to buffer overflow.

WinAce provided by e-merge GmbH is software to compress and decompress files in multiple types of compression format.

WinAce is vulnerable to buffer overflow. When WinAce decompresses a specially crafted file, this vulnerability can be exploited to execute arbitrary code with the privilege of the user running the application.

Base Metrics: 6.8 (Medium) [IPA Score]

• Access Vector: Network
• Access Complexity: Medium
• Authentication: None
• Confidentiality Impact: Partial
• Integrity Impact: Partial
• Availability Impact: Partial

e-merge GmbH

• WinAce 2.6.5 and earlier

Arbitrary code can be executed with the privilege of the user running the application.

[Update the Software]
Apply the latest update provided by the vendor.

e-merge GmbH

• e-merge GmbH : NEW: WinAce 2.69 is available for download

1. JVN : JVN#44736880
2. National Vulnerability Database (NVD) : CVE-2007-6563
3. Common Vulnerabilities and Exposures (CVE) : CVE-2007-6563
4. Fourteenforty Released Advisory : FFRRA-20071225
5. Secunia Advisory : SA28215
6. SecurityFocus : 27017
7. ISS X-Force Database : 39268
8. FrSIRT Advisories : FrSIRT/ADV-2007-4312
9. Common Weakness Enumeration (CWE) : Buffer Errors (CWE-119) [NVD Evaluation]

[2008/05/21]
  Web page published