unace-2.x buffer overflow

[Ulf Härnhammar <Ulf.Harnhammar.9485 () student uu se>]

One of the buffer overflows in unace-1.x affects unace-2.x as well.

The Gentoo guys originally found this in a bug report [1] where they
were testing unace-2.2 after upgrading unace-1.2b. As stated there,
unace-2.2 crashes when listing (l), testing (t) or verbosely listing
(v) my bufoflow1.ace archive.

I looked further into this, and I found that it in fact is an
exploitable buffer overflow where the attacker controls EIP. I also
found that it affects all versions of unace-2.x that I checked,
namely 2.04, 2.2 and 2.5.

I also checked WinAce running on Windows XP for this bug with
inconclusive results.

[1] http://bugs.gentoo.org/show_bug.cgi?id=81958

// Ulf Härnhammar

Attachment: bufoflow1.ace
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html