Basic search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:24184
HistoryJul 07, 2010 - 12:00 a.m.

[Bkis-03-2010] Vulnerability in Flash Slideshow Maker Vulnerability

2010-07-0700:00:00
vulners.com
4

[Bkis-03-2010] Vulnerability in Flash Slideshow Maker Vulnerability

  1. General Information
    Flash Slideshow Maker is a Flash album creator to make animated photo slide
    show with SWF file as the output format. Bkis has just detected a
    vulnerability in the software related to the processing of Flash Slideshow
    Maker project files (".fss"). This vulnerability permits hackers to execute
    malicious code on users' systems. Bkis has informed the vendor.

Details: http://security.bkis.com/vulnerability-in-flash-slideshow-maker/
SVRT Advisory: Bkis-03-2010
Initial vendor notification: 05/31/2010
Release Date: 07/01/2010
Update Date: 07/01/2010
Discovered by: Bui Quang Minh - Bkis
Attack Type: Buffer Overflow
Security Rating: High
Impact: Code Execution
Affected Software: Flash Slideshow Maker < v5.00

2.Technical Description
FSS files are used to store essential information about a Flash Slideshow
Maker Project (in XML format). The software performs an inadequate check on
the length of a Photo_Data tag. This results in a critical buffer overflow
error when this tag set with an overly long value.

In order to exploit this vulnerability, a hacker might create a specially
crafted ".fss" file and trick users into using it. If successful, hackers
can perform local attack, inject viruses, steal sensitive information and
even take control of the victim's system.

  1. Solution
    Rating this vulnerability high severity and due to the fact that the vendor
    hasn't released any patch for this vulnerability, Bkis recommends that users
    should not open any untrusted FSS file.