[NT] PowerArchiver ACE and ARJ Archive Handling Buffer Overflow

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  PowerArchiver ACE and ARJ Archive Handling Buffer Overflow
------------------------------------------------------------------------


SUMMARY

" <http://www.powerarchiver.com/> PowerArchiver is an award-winning 
archive utility for the Windows family that provides support for most 
compressed and encoded files, as well as access to many powerful features 
and tools through an easy to use interface that seamlessly integrates with 
Windows Explorer."

A vulnerability within PowerArchiver allows attackers to cause the program 
to execute arbitrary code with due to a buffer overflow.

DETAILS

Vulnerable Systems:
 * PowerArchiver 2006 version 9.5 Beta 5
 * PowerArchiver 2006 version 9.5 Beta 4
 * PowerArchiver 2004 version 9.25
 * PowerArchiver 2003 version 8.60
 * PowerArchiver 2002 version 8.10

Immune Systems:
 * PowerArchiver 2006 version 9.26

The vulnerability is caused due to a boundary error when reading the 
filename of a compressed file from an ACE/ARJ archive. This can be 
exploited to cause a stack-based buffer overflow when a malicious archive 
containing a file with an overly long filename is opened.

Successful exploitation allows arbitrary code execution.

Disclosure Timeline:
09/09/2005 - Initial vendor notification
20/09/2005 - Vendor provided fixed version for testing
22/09/2005 - Vendor released fixed versions
23/09/2005 - Public disclosure


ADDITIONAL INFORMATION

The information has been provided by  <mailto:vuln@xxxxxxxxxxx> Secunia 
Research.
The original article can be found at:  
<http://secunia.com/advisories/16713/> 
http://secunia.com/advisories/16713/



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.