A vulnerability has been identified in multiple SpeedProject products, which could be exploited by malicious people to conduct directory traversal. This flaw is due to an input validation error when extracting malformed ZIP and JAR archives, which could be exploited by attackers to place malicious files in arbitrary directories by convincing a user to extract a specially crafted archive.

Affected Products

Speedproject SpeedCommander version 11.01 Build 4450 and prior
Speedproject ZipStar version 5.10 and prior
Speedproject Squeez version 5.10 and prior

Solution

VUPEN Security is not aware of any vendor-supplied patch.

References

http://www.vupen.com/english/advisories/2006/0731
http://www.vupen.com/english/reference/6459

Credits

Vulnerability reported by Hamid Ebadi

Changelog

2006-02-24 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.