ID

VAR-200908-0093

CVE

CVE-2008-7009

TITLE

Check Point ZoneAlarm Security Suite of multiscan.exe Vulnerable to buffer overflow

DESCRIPTION

Buffer overflow in multiscan.exe in Check Point ZoneAlarm Security Suite 7.0.483.000 and 8.0.020.000 allows local users to execute arbitrary code via a file or directory with a long path. NOTE: some of these details are obtained from third party information. ZoneAlarm Security Suite is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input when performing virus scans on long directory paths. Remote attackers may leverage this issue to execute arbitrary code with SYSTEM-level privileges and gain complete access to the vulnerable computer. Failed attacks will cause denial-of-service conditions. This issue affects ZoneAlarm Security Suite 7.0.483.000; other versions may also be affected. ZoneAlarm is a personal computer firewall that protects personal data and privacy. ---------------------------------------------------------------------- Do you need accurate and reliable IDS / IPS / AV detection rules? Get in-depth vulnerability details: http://secunia.com/binary_analysis/sample_analysis/ ---------------------------------------------------------------------- TITLE: ZoneAlarm Internet Security Suite "multiscan.exe" Buffer Overflow SECUNIA ADVISORY ID: SA31832 VERIFY ADVISORY: http://secunia.com/advisories/31832/ CRITICAL: Less critical IMPACT: System access WHERE: >From remote SOFTWARE: ZoneAlarm Internet Security Suite 8.x http://secunia.com/advisories/product/19816/ ZoneAlarm Internet Security Suite 7.x http://secunia.com/advisories/product/19815/ DESCRIPTION: Juan Pablo Lopez Yacubian has discovered a vulnerability in ZoneAlarm Internet Security Suite, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to a boundary error in multiscan.exe when processing input from files passed via the "-f" command line parameter. This can be exploited to cause a buffer overflow by e.g. tricking a user into scanning a file or directory with a specially crafted name via the "Scan with ZoneAlam Anti-virus" shell extension. Successful exploitation may allow the execution of arbitrary code. The vulnerability is confirmed in version 7.0.483.000 and 8.0.020.000. SOLUTION: A solution is not available. PROVIDED AND/OR DISCOVERED BY: Juan Pablo Lopez Yacubian ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

buffer overflow

CONFIGURATIONS

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Juan Pablo Lopez Yacubian※ jplopezy@gmail.com

SOURCES

LAST UPDATE DATE

2024-11-23T22:31:52.044000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE