Secunia

Rafel Ivgi has discovered a weakness in Kazaa Lite K++, which can be exploited by malicious people to create or overwrite files on a user's system.

The included K-Sig KL Extension (KSig.exe) installs a "sig2dat://" URI handler. The weakness is caused due to an input validation error when processing the "File:" argument of "sig2dat://" URIs. This can be exploited via a directory traversal attack to create or overwrite .dat files in arbitrary locations on a user's system by e.g. tricking the user into visiting a malicious web site or follow a specially crafted link.

An error within the handling of the "Length" value was also reported, which crashes the K-Sig KL Extension with an EConvertError exception when processing an overly large value.

The weakness has been confirmed in Kazaa Lite K++ 2.4.3 with K-Sig 1.2.3 (Build 5). Other versions may also be affected.

Solution
Remove the association for the "sig2dat://" URI handler. This may impact the functionality.

Provided and/or discovered by
Rafel Ivgi

Original Advisory
http://theinsider.deep-ice.com/texts/advisory70.txt

Deep Links
Links available in Customer Area