Brett Gervasoni has reported a vulnerability in SafeNet SoftRemote, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to a boundary error in spdedit.exe when processing policy files (".spd"). This can be exploited to cause a stack-based buffer overflow via a policy file containing overly long "TREENAME" or "GROUPNAME" fields.

Successful exploitation may allow execution of arbitrary code, but requires that the user is tricked into importing a malicious ".spd" file.

The vulnerability is reported in version 10.8.5 build 2 and version 10.3.5 build 6. Other versions may also be affected.

Solution
Reportedly fixed in version 10.8.9.

Provided and/or discovered by
Brett Gervasoni, SOS Labs

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.senseofsecurity.com.au/advisories/SOS-09-008

Deep Links
Links available to Secunia VIM customers