OSVDB ID: 23066

Title: Verity KeyView Viewer SDK kvarcve.dll Compressed File Preview Traversal Arbitrary File Deletion

Info

Disclosure
Feb 10, 2006

Discovery
Unknown

Dates

Exploit
Unknown

Solution
Unknown

Description

 Verity KeyView Viewer SDK contains a flaw that allows a remote attacker to delete arbitrary files. The issue is due to 'kvarcve.dll' not properly checking the filenames of compressed files in ZIP, UUE, and TAR archives for traversal style attacks (../../) when generating their previews.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Unknown

Solution

 Upgrade to version 8.2, 9.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Autonomy

Verity KeyView Viewer SDK

 7.0a
7.4

International Business Machines Corporation

Lotus Notes

 6.5.3
6.0.4
6.0
6.0.1
6.0.1.1
6.0.1.2
6.0.1.3
6.0.2.1
6.0.2.2
6.0.3
6.0.5
6.5
6.5.1
6.5.2
6.5.2.1
6.5.3.1
7.0

References

Credit
  • Tan Chew Keong - vulnsecunia.com - Secunia Research
  • Carsten Eiram -   -


Direct URL: http://osvdb.org/23066