7a69Adv#20 - ZipGenius unpack one-folder path disclosure

[Albert Puigsech Galicia]

=2D ------------------------------------------------------------------
=A0 =A0 =A0 =A07a69ezine Advisories =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0=
=A07a69Adv#20
=2D ------------------------------------------------------------------
=A0 http://www.7a69ezine.org =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =
=A0 =A0 =A0[02/02/2005]
=2D ------------------------------------------------------------------

Title: =A0 =A0 =A0 =A0ZipGenius unpack one-folder path disclosure

Author: =A0 =A0 =A0 Albert Puigsech Galicia - <ripe@7a69ezine.org>

Software: =A0 =A0 ZipGenius

Versions: =A0 =A0 >=3D 5.5

Remote: =A0 =A0 =A0 yes

Exploit: =A0 =A0 =A0yes

Severity: =A0 =A0 Low

=2D ------------------------------------------------------------------



I. Introduction.

=A0ZipGenius is a file compression suite that supports more than 20 formats=
of=20
compressed archives including RAR, ARJ, ACE, CAB, SQX and ZIP. It's free an=
d=20
easy to use, and you can download it from http://www.zipgenius.it.



II. Description.


=A0Zipgenius adds some options to unpack files directly using left-click. T=
he=20
option of extracting files directly in the directory allows you to store th=
e=20
files ina a directory that takes the same name of the compressed file but=20
without the extension, so if the filename is '...zip' and you use this opti=
on=20
the uncompressed data will be stored on "../" folder.



III. Exploit

=A0It's realy hard to exploit this issue in a real scenario, because you ca=
n't=20
know where the malicious file will. But, for example, if it's on 'C:/temp'=
=20
you can create any file on the root filesystem.

Windows does not allow to create a files with the apropiate name to exploi=
t=20
the vulnerability, but you can use other sistem to do it.
=A0


IV. Patch

Update to ZipGenius 6 Beta.
=A0

V. Timeline

02/01/2005 =A0- =A0Bug discovered
10/01/2005 =A0- =A0Mail sent to zginfo@zipgenius.it
16/01/2005 =A0- =A0Mail sent to zginfo@zipgenius.it again
18/01/2005 - Vendor response
20/01/2005 - Solved in beta version
02/02/2005 - Advisor released



VI. Extra data

=A0You can find more 7a69ezine advisories on this following link:

=A0 =A0 http://www.7a69ezine.org/avisos/propios [spanish info]