=2D ------------------------------------------------------------------
7a69ezine Advisories 7a69Adv#21
=2D ------------------------------------------------------------------
http://www.7a69ezine.org [02/02/2005]
=2D ------------------------------------------------------------------

Title: WinRAR unpack one-folder path disclosure

Author: Albert Puigsech Galicia - <ripe@7a69ezine.org>

Software: WinRAR

Versions: >=3D 3.42

Remote: yes

Exploit: yes

Severity: Low

=2D ------------------------------------------------------------------



I. Introduction.

WinRAR is an archive manager that can create and decompress ZIP, RAR and=20
other files. You can download this software and get more info about it from=
=20
http://www.rarlab.com.



II. Description.


WinRAR adds some options to unpack files directly using left-click. The=20
option of extracting files directly in the directory allows you to store th=
e=20
files ina a directory that takes the same name of the compressed file but=20
without the extension, so if the filename is '...zip' and you use this opti=
on=20
the uncompressed data will be stored on "../" folder.



III. Exploit

It's realy hard to exploit this issue in a real scenario, because you can'=
t=20
know where the malicious file will. But, for example, if it's on 'C:/temp'=
=20
you can create any file on the root filesystem.

=A0Windows does not allow to create a files with the apropiate name to expl=
oit=20
the vulnerability, but you can use other sistem to do it.
=20


IV. Patch

No oficial patch avaliable. Be careful unpacking untrusted files.



V. Timeline

02/01/2005 - Bug discovered
16/01/2005 - Mail sent to dev@rarlab.com
16/01/2005 - Fast vendor response
02/02/2005 - Advisor released




VI. Extra data

You can find more 7a69ezine advisories on this following link:

http://www.7a69ezine.org/avisos/propios [spanish info]