[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Bkis-03-2010] Vulnerability in Flash Slideshow Maker Vulnerability

[Bkis-03-2010] Vulnerability in Flash Slideshow Maker Vulnerability

1. General Information
Flash Slideshow Maker is a Flash album creator to make animated photo slide show with SWF file as the output format. Bkis has just detected a vulnerability in the software related to the processing of Flash Slideshow Maker project files (".fss"). This vulnerability permits hackers to execute malicious code on users' systems. Bkis has informed the vendor.

Details: http://security.bkis.com/vulnerability-in-flash-slideshow-maker/
SVRT Advisory: Bkis-03-2010
Initial vendor notification: 05/31/2010
Release Date: 07/01/2010
Update Date: 07/01/2010
Discovered by: Bui Quang Minh - Bkis
Attack Type: Buffer Overflow
Security Rating: High
Impact: Code Execution
Affected Software: Flash Slideshow Maker < v5.00

2.Technical Description
FSS files are used to store essential information about a Flash Slideshow Maker Project (in XML format). The software performs an inadequate check on the length of a Photo_Data tag. This results in a critical buffer overflow error when this tag set with an overly long value.

In order to exploit this vulnerability, a hacker might create a specially crafted ".fss" file and trick users into using it. If successful, hackers can perform local attack, inject viruses, steal sensitive information and even take control of the victim's system.

3. Solution
Rating this vulnerability high severity and due to the fact that the vendor hasn't released any patch for this vulnerability, Bkis recommends that users should not open any untrusted FSS file.