pon software Archive Decoder Insecure Executable Loading Vulnerability (CVE-2010-3160)

Vulnerability Overview Vulnerability ID: JVN#68536660 Title: Archive Decoder may insecurely load executable files Release Date: 2010/10/20 Last Updated: 2010/10/20 Affected Products Archive Decoder Ver.1.23 and earlier versions Description Archive Decoder is a file extraction software supporting multiple file formats. When extracting files, it loads certain executable files (.exe). Archive Decoder has an issue in its file search path that may lead to insecure loading of executable files. Impact An attacker can execute arbitrary code with the privileges of the running application. Solution Update the software to the latest version. Update Notice: Update according to information provided by the developer. Vendor Status Vendor: pon software Status: Affected Last Update: 2010/10/20 Vendor Notes: http://www.ponsoftware.com/en/ Vulnerability Analysis Analysis Date: 2010.10.20 Access Requirements: Attackable via network using packets Authentication: Anonymous or no authentication (IP address does not count as authentication) User Interaction Required: User must be persuaded to perform a general action (appearing harmless to most users), such as clicking a link or viewing a file Exploit Complexity: User must be persuaded to perform difficult or suspicious actions; users with privileges are more likely to be cautious All the above analyses indicate a high-risk vulnerability. Source Reported to IPA by Makoto Shiotsuki. JPCERT/CC coordinated with the developer under the Information Security Early Warning Partnership. Additional Information JPCERT Warning JPCERT Report CERT Notification CPNI Notification TRnotes Related CVE: CVE-2010-3160 JVN iPedia: JVNDB-2010-000044

Goal Reached Thanks to every supporter — we hit 100%!

pon software Archive Decoder Insecure Executable Loading Vulnerability (CVE-2010-3160)