vendor:
UltraISO
by:
jduck
7.6
CVSS
HIGH
Stack-based Buffer Overflow
119
CWE
Product Name: UltraISO
Affected Version From: Unknown
Affected Version To: v9.3.6.2750
Patch Exists: YES
Related CWE: CVE-2009-1260
CPE: a:ezb_systems:ultraiso
Platforms Tested: Windows
2010
UltraISO CCD File Parsing Buffer Overflow
This module exploits a stack-based buffer overflow in EZB Systems, Inc's UltraISO. When processing .CCD files, data is read from file into a fixed-size stack buffer. Since no bounds checking is done, a buffer overflow can occur. Attackers can execute arbitrary code by convincing their victim to open an CCD file. NOTE: A file with the same base name, but the extension of 'img' must also exist. Opening either file will trigger the vulnerability, but the files must both exist.
Mitigation:
Ensure that you have the latest version of UltraISO installed, as this issue has been fixed in newer versions. Additionally, exercise caution when opening CCD files from untrusted sources.