TITLE:
Virtools Web Player Buffer Overflow and Directory Traversal
Vulnerabilities

SECUNIA ADVISORY ID:
SA17034

VERIFY ADVISORY:
http://secunia.com/advisories/17034/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass, System access

WHERE:
>From remote

SOFTWARE:
Virtools Web Player 3.x
http://secunia.com/product/5789/

DESCRIPTION:
Luigi Auriemma has reported two vulnerabilities in Virtools Web
Player, which potentially can be exploited by malicious people to
compromise a user's system.

1) A boundary error when handling a ".vmo" file that contains a file
with an overly long filename can be exploited to cause a buffer
overflow and may allow arbitrary code execution.

2) A directory traversal error when handling a ".vmo" file that
contains a file with directory traversal sequences in its filename
can be exploited to create or overwrite arbitrary files on the
system.

Successful exploitation requires that the user is e.g. tricked into
following a link to a malicious ".vmo" file in the browser.

The vulnerabilities have been reported in version 3.0.0.100 and
prior.

SOLUTION:
Update to version 3.0.0.101.
http://player.virtools.com/download.asp

PROVIDED AND/OR DISCOVERED BY:
Luigi Auriemma

ORIGINAL ADVISORY:
http://aluigi.altervista.org/adv/virtbugs-adv.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------