Jul 01 2010
Vulnerability in Flash Slideshow Maker
General Information
Flash Slideshow Maker is a Flash album creator to make animated photo slide show with SWF file as the output format. Bkis has just detected a vulnerability in the software related to the processing of Flash Slideshow Maker project files (“.fss”). This vulnerability permits hackers to execute malicious code on users’ systems. Bkis has informed the vendor.
|
Details |
|
|
SVRT Advisory |
Bkis-03-2010 |
|
CVE reference |
|
|
Initial vendor notification |
05/31/2010 |
|
Release Date |
07/01/2010 |
|
Update Date |
07/01/2010 |
|
Discovered by |
Bui Quang Minh, Bkis |
|
Attack Type |
Buffer Overflow |
|
Security Rating |
High |
|
Impact |
Code Execution |
|
Affected Software |
Flash Slideshow Maker < v5.00 |
Technical Description
FSS files are used to store essential information about a Flash Slideshow Maker Project (in XML format). The software performs an inadequate check on the length of a Photo_Data tag. This results in a critical buffer overflow error when this tag is set with an overly long value.
In order to exploit this vulnerability, a hacker might create a specially crafted “.fss” file and trick users into using it. If successful, hackers can perform local attack, inject viruses, steal sensitive information and even take control of the victim’s system.
Solution
Rating this vulnerability high severity and due to the fact that the vendor hasn’t released any patch for this vulnerability, Bkis recommends that users should not open any untrusted FSS file.
Bkis