Walied Assar has discovered a vulnerability in Resource Tuner, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error when parsing the resource section within Portable Executable (PE) files. This can be exploited to cause a heap-based buffer overflow via a specially crafted resource entry size value.

Successful exploitation allows execution of arbitrary code, but requires tricking a user into processing a file.

The vulnerability is confirmed in version 1.99 R6. Other versions may also be affected.

Solution
Do not process files from untrusted sources.

Provided and/or discovered by
Walied Assar

Original Advisory
Walied Assar:
http://waleedassar.blogspot.com/2012/05/resource-tuner-heap-overflow.html

Deep Links
Links available to Secunia VIM customers