One of the buffer overflows in unace-1.x affects unace-2.x as well. The Gentoo guys originally found this in a bug report [1] where they were testing unace-2.2 after upgrading unace-1.2b. As stated there, unace-2.2 crashes when listing (l), testing (t) or verbosely listing (v) my bufoflow1.ace archive.
I looked further into this, and I found that it in fact is an exploitable buffer overflow where the attacker controls EIP. I also found that it affects all versions of unace-2.x that I checked, namely 2.04, 2.2 and 2.5. I also checked WinAce running on Windows XP for this bug with inconclusive results. [1] http://bugs.gentoo.org/show_bug.cgi?id=81958 // Ulf H�rnhammar
bufoflow1.ace
Description: Binary data
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
