Vulnerability Description
Multiple stack-based buffer overflows in Autonomy (formerly Verity) KeyView SDK before 9.2.0, as used in Lotus Notes 6.5.4 and 7.0, allow remote attackers to execute arbitrary code via (1) a UUE file containing an encoded file with a long filename handled by uudrdr.dll, (2) a compressed ZIP file with a long filename handled by kvarcve.dll, (3) a TAR archive with a long filename that is extracted to a directory with a long path handled by the TAR reader (tarrdr.dll), (4) an email that contains a long HTTP, FTP, or // link handled by the HTML speed reader (htmsr.dll) or (5) an email containing a crafted long link handled by the HTML speed reader (htmsr.dll).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Autonomy | Keyview Export Sdk | All versions |
| Autonomy | Keyview Filter Sdk | All versions |
| Autonomy | Keyview Viewer Sdk | All versions |
| Ibm | Lotus Notes | 6.0.1 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/16100PatchVendor Advisory
- http://secunia.com/advisories/16280PatchVendor Advisory
- http://secunia.com/secunia_research/2005-32/advisory/Vendor Advisory
- http://secunia.com/secunia_research/2005-34/advisory/Vendor Advisory
- http://secunia.com/secunia_research/2005-36/advisory/Vendor Advisory
- http://secunia.com/secunia_research/2005-37/advisory/Vendor Advisory
- http://secunia.com/secunia_research/2005-66/advisory/Vendor Advisory
- http://securitytracker.com/id?1015657Patch
- http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229918Patch
- http://www.kb.cert.org/vuls/id/884076Third Party AdvisoryUS Government Resource
- http://www.osvdb.org/23064Patch
- http://www.osvdb.org/23065Patch
- http://www.osvdb.org/23066Patch
- http://www.osvdb.org/23067Patch
- http://www.osvdb.org/23068Patch
FAQ
What is CVE-2005-2618?
CVE-2005-2618 is a vulnerability with a CVSS score of 9.3 (HIGH). Multiple stack-based buffer overflows in Autonomy (formerly Verity) KeyView SDK before 9.2.0, as used in Lotus Notes 6.5.4 and 7.0, allow remote attackers to execute arbitrary code via (1) a UUE file ...
How severe is CVE-2005-2618?
CVE-2005-2618 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2005-2618?
Check the references section above for vendor advisories and patch information. Affected products include: Autonomy Keyview Export Sdk, Autonomy Keyview Filter Sdk, Autonomy Keyview Viewer Sdk, Ibm Lotus Notes.