[security-alerts] FW: [SA19454] Total Commander unacev2.dll Buffer Overflow Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> 
> TITLE:
> Total Commander unacev2.dll Buffer Overflow Vulnerability
> 
> SECUNIA ADVISORY ID:
> SA19454
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/19454/
> 
> CRITICAL:
> Moderately critical
> 
> IMPACT:
> System access
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> Total Commander 6.x
> http://secunia.com/product/3312/
> 
> DESCRIPTION:
> A vulnerability has been reported in Total Commander, which can be
> exploited by malicious people to compromise a user's system.
> 
> The vulnerability is caused due to a boundary error in UNACEV2.DLL
> when extracting an ACE archive containing a file with an overly long
> filename. This can be exploited to cause a stack-based buffer
> overflow when a user extracts a specially crafted ACE archive.
> 
> The vulnerability is related to:
> SA16479
> 
> The vulnerability has confirmed in version 6.53. Prior versions may
> also be affected.
> 
> SOLUTION:
> Update to version 6.54 or later.
> http://www.ghisler.com/download.htm
> 
> PROVIDED AND/OR DISCOVERED BY:
> Originally reported by Secunia Research in ALZip.
> 
> Reported in Total Commander by vendor.
> 
> OTHER REFERENCES:
> SA16479:
> http://secunia.com/advisories/16479/
>