XP vulnerability can provide full system access

Takes advantage of twelve years old vulnerability in widespread Windows library.

Secunia reports that it has been found a vulnerability in Windows XP and 2000 that could allow malicious to compromise a vulnerable system.

The vulnerability is due to a boundary error in the function UpdateFrameTitleForDocument () contained in the CFrameWnd class library file mfc42.dll. Microsoft Foundation Classes (MFC) is a standard C + +-based framework for applications that were introduced by Microsoft in 1992.

The vulnerability can be exploited to cause a stack-based buffer overflow by transferring an overly long title-string argument to the above feature.
Successful exploitation of the vulnerability may be open to the execution of arbitrary code.

According to Secunia the vulnerability exists in fully updated editions of Windows 2000 Professional SP4 and Windows XP SP3.

Already it is confirmed that version PowerZip 7.2 Build 4010 is a valid attack vector. The vulnerability can be exploited if the user opens an archive file that contains a very long folder names.

It is confirmed that at least the versions 6.0.9586.0 and 6.2.4131.0 of mfc42.dll library is affected by the vulnerability. However, other versions and applications that use these can be affected.