TweakFS Zip Utility for FSX filename buffer overflow

Added: 06/24/2010
CVE: CVE-2010-1458
BID: 39565
OSVDB: 63899

Background

The TweakFS Zip Utility is included in the TweakFS Flight Simulator X Utilities.

Problem

A buffer overflow vulnerability in the TweakFS Zip Utility allows command execution when a user opens a ZIP archive containing a long, specially crafted filename.

Resolution

Do not open untrusted ZIP files using the TweakFS Zip Utility.

References

<http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0242.html&gt;

Limitations

Exploit works on TweakFS Zip Utility 1.0 and requires a user to open the exploit file.

Platforms

Windows