Multiple vulnerabilities were identified in Verity KeyView SDK, which could be exploited by remote attackers to execute arbitrary commands or bypass security restrictions.
The first issue is due to a buffer overflow error in "kvarcve.dll" when constructing the full pathname of a compressed file to check for its existence before extracting it from a compressed file, which could be exploited by attackers to compromise a vulnerable system by convincing a user to extract a ZIP archive via the attachment viewer.
The second flaw is due to a buffer overflow error in "uudrdr.dll" when handling UUE files containing an encoded file with an overly long filename, which could be exploited by attackers to compromise a vulnerable system by convincing a user to open a UUE archive via the attachment viewer.
The third vulnerability is due to directory traversal errors in "kvarcve.dll" when generating the preview of a compressed file from ZIP, UUE, and TAR archives, which could be exploited by attackers to delete arbitrary files by convincing a user to preview a malicious file via the attachment viewer.
The fourth issue is due to a buffer overflow error in the TAR reader (tarrdr.dll) when extracting a malformed TAR archive, which could be exploited by attackers to compromise a vulnerable system by convincing a user to extract a malicious archive via the attachment viewer.
The fifth flaw is due to a buffer overflow error in the HTML speed reader (htmsr.dll) when processing a malicious document containing an overly long link beginning with either "http", "ftp", or "//", which could be exploited by attackers to compromise a vulnerable system by convincing a user to follow a malicious link.
The sixth vulnerability is due to a buffer overflow error in the HTML speed reader when handling a specially crafted document containing an overly long link, which could be exploited by attackers to execute arbitrary commands.
Credits
Vulnerabilities reported by Tan Chew Keong and Carsten Eiram.
ChangeLog
2006-02-10 : Initial release
Vulnerability Management
Subscribe to FrSIRT VNS and receive real-time e-mail and SMS alerts when new vulnerabilities, exploits, or patches relevant to your systems and network configurations are available.
Feedback
If you have additional information or corrections for this security advisory please submit them via our contact form or by email to updates@frsirt.com.
French
