Vulnerable Systems:
* Autonomy KeyView version 10.4
* Autonomy KeyView version 10.9
The vulnerability is caused by a boundary error when parsing record data in compound documents. This can be exploited to cause a heap-based buffer overflow when an application using the vulnerable library parses e.g. a specially crafted Quattro Pro file. Successful exploitation allows execution of arbitrary code.
Patch Availability:
Apply patches available from the vendor.
Disclosure Timeline:
03/03/2010 - Vulnerability details provided to the vendor.
16/04/2010 - Vendor provides status update.
28/07/2010 - Public disclosure.
