Albert Puigsech Galicia
02/02/05, 21:35
=2D ------------------------------------------------------------------
7a69ezine Advisories 7a69Adv#21
=2D ------------------------------------------------------------------
http://www.7a69ezine.org [02/02/2005]
=2D ------------------------------------------------------------------
Title: WinRAR unpack one-folder path disclosure
Author: Albert Puigsech Galicia - <ripe@7a69ezine.org>
Software: WinRAR
Versions: >=3D 3.42
Remote: yes
Exploit: yes
Severity: Low
=2D ------------------------------------------------------------------
I. Introduction.
WinRAR is an archive manager that can create and decompress ZIP, RAR and=20
other files. You can download this software and get more info about it from=
=20
http://www.rarlab.com.
II. Description.
WinRAR adds some options to unpack files directly using left-click. The=20
option of extracting files directly in the directory allows you to store th=
e=20
files ina a directory that takes the same name of the compressed file but=20
without the extension, so if the filename is '...zip' and you use this opti=
on=20
the uncompressed data will be stored on "../" folder.
III. Exploit
It's realy hard to exploit this issue in a real scenario, because you can'=
t=20
know where the malicious file will. But, for example, if it's on 'C:/temp'=
=20
you can create any file on the root filesystem.
=A0Windows does not allow to create a files with the apropiate name to expl=
oit=20
the vulnerability, but you can use other sistem to do it.
=20
IV. Patch
No oficial patch avaliable. Be careful unpacking untrusted files.
V. Timeline
02/01/2005 - Bug discovered
16/01/2005 - Mail sent to dev@rarlab.com
16/01/2005 - Fast vendor response
02/02/2005 - Advisor released
VI. Extra data
You can find more 7a69ezine advisories on this following link:
http://www.7a69ezine.org/avisos/propios [spanish info]
7a69ezine Advisories 7a69Adv#21
=2D ------------------------------------------------------------------
http://www.7a69ezine.org [02/02/2005]
=2D ------------------------------------------------------------------
Title: WinRAR unpack one-folder path disclosure
Author: Albert Puigsech Galicia - <ripe@7a69ezine.org>
Software: WinRAR
Versions: >=3D 3.42
Remote: yes
Exploit: yes
Severity: Low
=2D ------------------------------------------------------------------
I. Introduction.
WinRAR is an archive manager that can create and decompress ZIP, RAR and=20
other files. You can download this software and get more info about it from=
=20
http://www.rarlab.com.
II. Description.
WinRAR adds some options to unpack files directly using left-click. The=20
option of extracting files directly in the directory allows you to store th=
e=20
files ina a directory that takes the same name of the compressed file but=20
without the extension, so if the filename is '...zip' and you use this opti=
on=20
the uncompressed data will be stored on "../" folder.
III. Exploit
It's realy hard to exploit this issue in a real scenario, because you can'=
t=20
know where the malicious file will. But, for example, if it's on 'C:/temp'=
=20
you can create any file on the root filesystem.
=A0Windows does not allow to create a files with the apropiate name to expl=
oit=20
the vulnerability, but you can use other sistem to do it.
=20
IV. Patch
No oficial patch avaliable. Be careful unpacking untrusted files.
V. Timeline
02/01/2005 - Bug discovered
16/01/2005 - Mail sent to dev@rarlab.com
16/01/2005 - Fast vendor response
02/02/2005 - Advisor released
VI. Extra data
You can find more 7a69ezine advisories on this following link:
http://www.7a69ezine.org/avisos/propios [spanish info]