bugtraq - WinHKI 1.6x Archive Extraction Directory traversal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 21 Mar 2006 19:32:59 -0800 (PST)
From: h e <het_ebadi@...oo.com>
To: "bugs@...uritytracker.com" <bugs@...uritytracker.com>,
	"bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>,
	"content-editor@...urityfocus.com" <content-editor@...urityfocus.com>,
	"editor@...urityfocus.com" <editor@...urityfocus.com>,
	"expert@...uriteam.com" <expert@...uriteam.com>,
	"news-editor@...urityfocus.com" <news-editor@...urityfocus.com>,
	"support@...unia.com" <support@...unia.com>,
	"vuldb@...urityfocus.com" <vuldb@...urityfocus.com>,
	"vuln@...unia.com" <vuln@...unia.com>,
	"webmaster@...unia.com" <webmaster@...unia.com>,
	"webmaster@...urityfocus.com" <webmaster@...urityfocus.com>
Subject: WinHKI 1.6x Archive Extraction Directory traversal

WinHKI 1.6x Archive Extraction Directory traversal 
WinHKI Archiver administrator ask me for penetration
test. here is the result :

WinHKI Archiver: compression (hki, cab, zip, gzip,
tar, jar...) 
extract 14 formats (hki, rar, ace, zip, gzip, tar,
...) 
Encryption / Decryption support 
Full zip support ,own HKI format ,splitten and
spanning ,SFX Modul ,12 Languages

http://www.winhki.com
http://www.webtoolmaster.com

Credit:
The information has been provided by Hamid Ebadi
( Hamid Network Security Team) : admin@...id.ir.
The original article can be found at :
http://hamid.ir/security

Vulnerable Systems:
WinHKI 1.6 and Below

Detail :

The vulnerability is caused due to an input validation
error when extracting files compressed with RAR (.rar)
or TAR (.tar) or  ZIP (.zip) or TAR.GZ (tar.gz)
This makes it possible to have files extracted to
arbitrary locations outside the specified directory
using the "../" directory traversal sequence.

Solution:
resolved issue and fix will be available in next
release .

Do not extract untrusted  RAR and TAR and ZIP and
TAR.GZ files.
To reduce the risk, never extract files as an
administrative user.

harmless exploit:
use HEAP [Hamid Evil Archive Pack]
you can download it from Hamid Network Security Team :

http://www.hamid.ir/tools/

want to know more ?
http://www.hamid.ir/paper

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com