pyrokinesis has discovered a vulnerability in Pinnacle Hollywood FX, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an input validation error in InstallHFZ.exe when opening Hollywood FX archives (".hfz"). This can be exploited to write files to arbitrary directories via archives containing directory traversal sequences in the compressed filename.

The vulnerability is confirmed in version InstallHFZ.exe version 6.5.201.0. Other versions may also be affected.

Solution
Do not open untrusted ".hfz" files.

Provided and/or discovered by
pyrokinesis, Nine Situations Group

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://milw0rm.com/exploits/8670

Deep Links
Links available to Secunia VIM customers