header-logo
Suggest Exploit
vendor:
UltraISO
by:
jduck
7.6
CVSS
HIGH
Stack-based Buffer Overflow
119
CWE
Product Name: UltraISO
Affected Version From: Unknown
Affected Version To: v9.3.6.2750
Patch Exists: YES
Related CWE: CVE-2009-1260
CPE: a:ezb_systems:ultraiso
Metasploit:
Other Scripts:
Platforms Tested: Windows
2010

UltraISO CCD File Parsing Buffer Overflow

This module exploits a stack-based buffer overflow in EZB Systems, Inc's UltraISO. When processing .CCD files, data is read from file into a fixed-size stack buffer. Since no bounds checking is done, a buffer overflow can occur. Attackers can execute arbitrary code by convincing their victim to open an CCD file. NOTE: A file with the same base name, but the extension of 'img' must also exist. Opening either file will trigger the vulnerability, but the files must both exist.

Mitigation:

Ensure that you have the latest version of UltraISO installed, as this issue has been fixed in newer versions. Additionally, exercise caution when opening CCD files from untrusted sources.
Source

Exploit-DB raw data: