|
Brought to you by:
Suppliers of:
|
|
|
| |
CheckMark MultiLedger - "A proven integrated, networkable financial package for small businesses, MultiLedger is easy to use and installs quickly".
CheckMark MultiLedger accounting system for Windows is confirmed to be affected to a buffer overflow vulnerability due to its usage of a third-party DLL called DUNZIP32.dll. |
| |
Credit:
The information has been provided by Juha-Matti Laurio.
The original and article can be found at:
http://www.networksecurity.fi/advisories/multiledger.html
|
| |
Vulnerable Systems:
* CheckMark MultiLedger version 6.0.3. Other versions may also be affected.
* DynaZip library version 3.0.0.14 (According to InnerMedia version 5.00.03 and prior are affected)
Related advisories:
Windows Shell ZIP File Decompression DUNZIP32.DLL Buffer Overflow
The vulnerability is caused due to a boundary error in a 3rd-party compression library's (DUNZIP32.dll) old, vulnerable version used in company data restore functions. This can be exploited to cause a buffer overflow via a specially crafted company backup file. When a specially crafted .zip backup file containing a file with an overly long filename (a file name or files inside a ZIP) is opened, the application will crash and the attacker may be able to execute arbitrary code on user's system.
Vendor Status:
An updated software version 7.0.2 is available from vendor:
http://www.checkmark.com/support/patch_win_ml.php
"Installation Instructions: You need at least version 7.0 of MultiLedger for Windows in order to run this patch."
Software Updates for Registered Users:
http://www.checkmark.com/order/updates.php
Workaround:
As a workaround, Dunzip32.dll library can be deleted or renamed, or un-registered with the Windows "Regsvr32 /u" command.
NOTE: This method breaks application's Backup and Restore functions and is not recommended.
Disclosure Timeline:
* 24-Jan-2005 - Vulnerability researched and confirmed
* 24-Jan-2005 - Vendor was contacted, workarounds delivered to the vendor
* 24-Jan-2005 - Vendor's reply to CheckMark for Windows vulnerability
* 04-Mar-2005 - Vendor informed about upcoming, fixed version
* 11-Oct-2005 - Detailed research
* 26-Oct-2005 - Vendor was contacted again
* 26-Oct-2005 - Vendor's reply, vulnerability is fixed
* 28-Oct-2005 - Security companies and several CERT units contacted
|
|
|
|
|
