search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Autonomy KeyView SDK buffer overflow vulnerability

Vulnerability Note VU#276563

Original Release Date: 2009-03-19 | Last Revised: 2009-04-30

Overview

Autonomy KeyView SDK contains a buffer overflow vulnerability that may allow an attacker to execute arbitrary code.

Description

Autonomy KeyView SDK is a commercial software development kit (SDK) that includes file filtering libraries. A vulnerability exists in the way the SDK libraries process specially crafted WordPerfect documents. According to iDefense:

This vulnerability exists within the "wp6sr.dll," which implements the processing of WordPerfect documents. When processing certain records, data is copied from the file into a fixed-size stack buffer without ensuring that enough space is available. By overflowing the buffer, an attacker can overwrite control flow structures stored on the stack.

Note that this issue affects products that use Autonomy KeyView SDK. These include IBM Lotus Notes and Symantec products.

Impact

An unauthenticated attacker may be able to execute arbitrary code or cause a vulnerable system to crash.

Solution

Apply updates

Developers should contact Autonomy KeyView support for information on how to obtain updated software that addresses this issue.

IBM Lotus Notes has released an alert to address this issue.

Symantec has released SYM09-004 to address this issue.

Vendor Information

276563
 
Affected   Unknown   Unaffected

Autonomy

Updated:  March 19, 2009

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

Customers should contact Autonomy KeyView support for more information.

IBM Corporation

Updated:  March 19, 2009

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

IBM Lotus Notes has released an alert to address this issue.

Symantec

Updated:  March 19, 2009

Status

  Vulnerable

Vendor Statement

No statement is currently available from the vendor regarding this vulnerability.

Vendor Information

Symantec has released SYM09-004 to address this issue.


CVSS Metrics

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A

References

Acknowledgements

This issue was made public by iDefense

This document was written by Chris Taschner.

Other Information

CVE IDs: CVE-2008-4564
Severity Metric: 6.00
Date Public: 2009-03-17
Date First Published: 2009-03-19
Date Last Updated: 2009-04-30 18:30 UTC
Document Revision: 9

Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.