TweakFS Zip Utility for FSX filename buffer overflow

2010-06-24T00:00:00
ID SAINT:F8453FBB6FA9B98A6A0CDEB20E641EAC
Type saint
Reporter SAINT Corporation
Modified 2010-06-24T00:00:00

Description

Added: 06/24/2010
CVE: CVE-2010-1458
BID: 39565
OSVDB: 63899

Background

The TweakFS Zip Utility is included in the TweakFS Flight Simulator X Utilities.

Problem

A buffer overflow vulnerability in the TweakFS Zip Utility allows command execution when a user opens a ZIP archive containing a long, specially crafted filename.

Resolution

Do not open untrusted ZIP files using the TweakFS Zip Utility.

References

<http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0242.html>

Limitations

Exploit works on TweakFS Zip Utility 1.0 and requires a user to open the exploit file.

Platforms

Windows