Total Commander unacev2.dll Buffer Overflow Vulnerability

[captjlddavis]

Total Commander unacev2.dll Buffer Overflow Vulnerability

SECUNIA ADVISORY ID:
SA19454

VERIFY ADVISORY:
http://secunia.com/advisories/19454/

If already posted - please dis-regard

captjlddavis

[majkinetor !]

thx for this info.

I am going to shutdown internal ace packer.

[DarkRuleR]

Updating to version >6.54 is a solution too.

Quote from the website secunia:

Solution:
Update to version 6.54 or later.
http://www.ghisler.com/download.htm

DR...

[ghisler(Author)]

Indeed this DLL is from the original ACE author, and used as a "black box" by Total Commander. I have updated it in TC6.54 because of this vulnerability.

[GuusQu]

Indeed this DLL is from the original ACE author, and used as a "black box" by Total Commander. I have updated it in TC6.54 because of this vulnerability.

Is there an official statement about this.
In our compagny the will bann Total Commander because of this!!!

[Lefteous]

2GuusQu

Is there an official statement about this.

Yes the statement you quoted is an official statement.

In our compagny the will bann Total Commander because of this!!!

Maybe your company should just upgrade to 6.54 instead of banning the program.

[GuusQu]

We use 6.54a! This version is released at feb.06.06.

The information we have is dated april 03.06
http://www.securiteam.com/windowsntfocus/5JP030UIAE.html

So this article is outdated?

[Lefteous]

2GuusQu

So this article is outdated?

It just doesn't apply to 6.54. They write that it applies to 6.x but this is wrong. The answer to your question is yes it is outdated.

IMHO it's better when a security problem is fixed before a problem is made public. After the bug has been fixed you could read on some security pages that there is a security issue with older versions (6.53 and older).

Read here:
http://secunia.com/advisories/19454/

You can verify that the problem is solved by testing the example archive on the page you linked to.

[GuusQu]

Thanks for the fast response! I'll drop it in the organisation ...
regards,
Guus