BitZipper Directory Traversal in Processing RAR/TAR/ZIP/GZ/JAR Archives Lets Remote Users Write Files to Arbitrary Locations
|
|
SecurityTracker Alert ID: 1016132
|
|
SecurityTracker URL: http://securitytracker.com/id?1016132
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: May 22 2006
|
Impact: Modification of system information, Modification of user information
|
Exploit Included: Yes
|
Version(s): 4.1.2 and prior versions
|
Description: Hamid Ebadi reported a vulnerability in BitZipper. A remote user can cause files to be written to arbitrary locations on the target system.
The software does not properly validate filenames when extracting files in RAR, TAR, ZIP, GZ (including TAR/GZ), or JAR files. A
remote user can create an archive that contains a file with '../' directory traversal characters in the name. When the target user
extracts the affected file, the file will be written to the arbitrary location specified by the target user. Files are created/written
with the privileges of the target user.
A demonstration exploit is available at:
http://www.hamid.ir/tools/
The original
advisory is available at:
http://www.hamid.ir/security/bitzipper.txt
|
Impact: A remote user can create an archive that, when extracted by the target user, will cause files to be written to arbitrary locations on the target system.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.bitzipper.com/ (Links to External Site)
|
Cause: Input validation error
|
Underlying OS: Windows (Any)
|
Reported By: h e <het_ebadi@yahoo.com>
|
Message History:
None.
|
Source Message Contents
|
Date: Sat, 20 May 2006 03:05:23 -0700 (PDT)
From: h e <het_ebadi@yahoo.com>
Subject: BitZipper Archive Extraction Directory traversal
|
http://www.hamid.ir/security/bitzipper.txt
BitZipper Archive Extraction Directory traversal
BitZipper is an advanced data compression tool for
Windows that enables you to unzip 18 different
compression and encoding formats with superior
ease-of-use.
Create 8 different types of compressed files
http://www.bitzipper.com
Credit:
The information has been provided by Hamid Ebadi
admin[at]hamid[dot]ir.
The original article can be found at :
http://hamid.ir/security
Vulnerable Systems:
BitZipper4.1.2 (and below)
[ 3.2 , 3.2.1 , 3.3 ,3.4 ,3.4.1,4.0 ,4.1,4.1 Service
Release 1 ]
Detail :
The vulnerability is caused due to an input validation
error when extracting files compressed with RAR (.rar)
or TAR (.tar) or ZIP (.zip) or TAR.GZ (tar.gz) or GZ
(.gz) or JAR(.jar)
This makes it possible to have files extracted to
arbitrary locations outside the specified directory
using the "../" directory traversal sequence.
Solution:
Do not extract untrusted RAR and TAR and JAR and GZ
and ZIP and TAR.GZ files.
To reduce the risk, never extract files as an
administrative user.
harmless exploit:
use HEAP [Hamid Evil Archive Pack]
you can download it from Hamid Network Security Team :
http://www.hamid.ir/tools/
want to know more ?
http://www.hamid.ir/paper/
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
|
|
