Autonomy KeyView SDK contains a buffer overflow vulnerability that may allow an attacker to execute arbitrary code.
Autonomy KeyView SDK is a commercial software development kit (SDK) that includes file filtering libraries. A vulnerability exists in the way the SDK libraries process specially crafted WordPerfect documents. According to iDefense:
This vulnerability exists within the “wp6sr.dll,” which implements the processing of WordPerfect documents. When processing certain records, data is copied from the file into a fixed-size stack buffer without ensuring that enough space is available. By overflowing the buffer, an attacker can overwrite control flow structures stored on the stack.
Note that this issue affects products that use Autonomy KeyView SDK. These include IBM Lotus Notes and Symantec products.
An unauthenticated attacker may be able to execute arbitrary code or cause a vulnerable system to crash.
Apply updates
Developers should contact Autonomy KeyView support for information on how to obtain updated software that addresses this issue.
IBM Lotus Notes has released an alert to address this issue.
Symantec has released SYM09-004 to address this issue.
276563
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Updated: March 19, 2009
Affected
We have not received a statement from the vendor.
Customers should contact Autonomy KeyView support for more information.
Updated: March 19, 2009
Affected
We have not received a statement from the vendor.
IBM Lotus Notes has released an alert to address this issue.
Updated: March 19, 2009
Affected
We have not received a statement from the vendor.
Symantec has released SYM09-004 to address this issue.
Group | Score | Vector |
---|---|---|
Base | 0 | AV:–/AC:–/Au:–/C:–/I:–/A:– |
Temporal | 0 | E:Not Defined (ND)/RL:Not Defined (ND)/RC:Not Defined (ND) |
Environmental | 0 | CDP:Not Defined (ND)/TD:Not Defined (ND)/CR:Not Defined (ND)/IR:Not Defined (ND)/AR:Not Defined (ND) |
This issue was made public by iDefense.
This document was written by Chris Taschner.
CVE IDs: | CVE-2008-4564 |
---|---|
Severity Metric: | 6.00 Date Public: |
labs.idefense.com/intelligence/vulnerabilities/display.php?id=774
secunia.com/advisories/34307/
secunia.com/advisories/34318/
securityresponse.symantec.com/avcenter/security/Content/2009.03.17a.html
www-01.ibm.com/support/docview.wss?uid=swg21377573
customers.autonomy.com/support/login.jsp?notLoggedIn=true&origURL=%2Fsecure%2Fdocs%2FUpdates%2FKeyview%2FFilter+SDK%2F10.4%2Fkv_update_nti40_10.4.zip.readme.html