----------------------------------------------------------------------

2003: 2,700 advisories published
2004: 3,100 advisories published
2005: 4,600 advisories published
2006: 5,300 advisories published

How do you know which Secunia advisories are important to you?

The Secunia Vulnerability Intelligence Solutions allows you to filter
and structure all the information you need, so you can address issues
effectively.

Get a free trial of the Secunia Vulnerability Intelligence Solutions:
https://corporate.secunia.com/how_to_buy/38/vi/?ref=secadv

----------------------------------------------------------------------

TITLE:
JustSystems Ichitaro Document Processing Multiple Buffer Overflows

SECUNIA ADVISORY ID:
SA27393

VERIFY ADVISORY:
https://secunia.com/advisories/27393/

CRITICAL:
Highly critical

IMPACT:
DoS, System access

WHERE:
>From remote

SOFTWARE:
Ichitaro viewer 4.x
https://secunia.com/product/12808/
Ichitaro Lite2
https://secunia.com/product/12807/
Ichitaro for Linux
https://secunia.com/product/11596/
Ichitaro 2007
https://secunia.com/product/13868/
Ichitaro 2006
https://secunia.com/product/11604/
Ichitaro 2005
https://secunia.com/product/11603/
Ichitaro 2004
https://secunia.com/product/11602/
Ichitaro 13.x
https://secunia.com/product/11601/
Ichitaro 12.x
https://secunia.com/product/11600/
Ichitaro 11.x
https://secunia.com/product/11599/
Ichitaro Punch
https://secunia.com/product/16316/

DESCRIPTION:
Hiroshi Ukai has reported some vulnerabilities in Ichitaro, which can
be exploited by malicious people to compromise a user's system.

1) Two boundary errors within JSTARO4.OCX can be exploited to cause
stack-based buffer overflows when a specially crafted document is
opened, e.g. via the browser plug-in.

2) A boundary error within TJSVDA.DLL can be exploited to cause a
buffer overflow when a specially crafted document is opened, e.g. via
the browser plug-in.

Successful exploitation allows execution of arbitrary code.

SOLUTION:
The vendor has released updates (please see vendor advisory for
details).
https://www.justsystems.com/jp/info/pd7004.html

PROVIDED AND/OR DISCOVERED BY:
Hiroshi Ukai, Fourteenfourty Research Institute

ORIGINAL ADVISORY:
JustSystems:
https://www.justsystems.com/jp/info/pd7004.html

Fourteenfourty Research Institute:
https://www.fourteenforty.jp/research/advisory.cgi?FFRRA-20071025-1
https://www.fourteenforty.jp/research/advisory.cgi?FFRRA-20071025-2
https://www.fourteenforty.jp/research/advisory.cgi?FFRRA-20071025-3

OTHER REFERENCES:
JVN:
https://jvn.jp/jp/JVN%2329211062/index.html
https://jvn.jp/jp/JVN%2332981509/index.html
https://jvn.jp/jp/JVN%2350495547/index.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
https://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
https://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------