Quickzip is prone to an overflow condition. The application fails to properly sanitize user-supplied input resulting in a stack buffer overflow. With a specially crafted zip file, an attacker can potentially cause code execution in the context of the currently logged on user.

Currently, there are no known upgrades or patches to correct this vulnerability. Since the the author of the application reported that he does not maintain this version anymore, quickzip users should avoid double-clicking files inside a zip file, or should consider using another zip solution.

• Exploit Database: 11656 11764
• Mail List Post: http://seclists.org/bugtraq/2010/Mar/135
• Generic Informational URL: http://www.corelan.be:8800/index.php/2010/03/07/corelanc0d3r-featured-on-offensive-security-blog/
• Other Advisory URL: http://www.offensive-security.com/blog/vulndev/quickzip-stack-bof-0day-a-box-of-chocolates/
  http://www.offensive-security.com/blog/vulndev/quickzip-stack-bof-a-box-of-chocolates-part-2/

• corelanc0d3r - Corelan Team

NVD does not currently have a CVSSv2 score assigned.