WinHKI 1.6x Archive Extraction Directory traversal
WinHKI Archiver administrator ask me for penetration
test. here is the result :
WinHKI Archiver: compression (hki, cab, zip, gzip,
tar, jar...)
extract 14 formats (hki, rar, ace, zip, gzip, tar,
...)
Encryption / Decryption support
Full zip support ,own HKI format ,splitten and
spanning ,SFX Modul ,12 Languages
Credit:
The information has been provided by Hamid Ebadi
( Hamid Network Security Team) : admin (at) hamid (dot) ir. [email concealed]
The original article can be found at :
http://hamid.ir/security
Vulnerable Systems:
WinHKI 1.6 and Below
Detail :
The vulnerability is caused due to an input validation
error when extracting files compressed with RAR (.rar)
or TAR (.tar) or ZIP (.zip) or TAR.GZ (tar.gz)
This makes it possible to have files extracted to
arbitrary locations outside the specified directory
using the "../" directory traversal sequence.
Solution:
resolved issue and fix will be available in next
release .
Do not extract untrusted RAR and TAR and ZIP and
TAR.GZ files.
To reduce the risk, never extract files as an
administrative user.
harmless exploit:
use HEAP [Hamid Evil Archive Pack]
you can download it from Hamid Network Security Team :
http://www.hamid.ir/tools/
want to know more ?
http://www.hamid.ir/paper
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
WinHKI Archiver administrator ask me for penetration
test. here is the result :
WinHKI Archiver: compression (hki, cab, zip, gzip,
tar, jar...)
extract 14 formats (hki, rar, ace, zip, gzip, tar,
...)
Encryption / Decryption support
Full zip support ,own HKI format ,splitten and
spanning ,SFX Modul ,12 Languages
http://www.winhki.com
http://www.webtoolmaster.com
Credit:
The information has been provided by Hamid Ebadi
( Hamid Network Security Team) : admin (at) hamid (dot) ir. [email concealed]
The original article can be found at :
http://hamid.ir/security
Vulnerable Systems:
WinHKI 1.6 and Below
Detail :
The vulnerability is caused due to an input validation
error when extracting files compressed with RAR (.rar)
or TAR (.tar) or ZIP (.zip) or TAR.GZ (tar.gz)
This makes it possible to have files extracted to
arbitrary locations outside the specified directory
using the "../" directory traversal sequence.
Solution:
resolved issue and fix will be available in next
release .
Do not extract untrusted RAR and TAR and ZIP and
TAR.GZ files.
To reduce the risk, never extract files as an
administrative user.
harmless exploit:
use HEAP [Hamid Evil Archive Pack]
you can download it from Hamid Network Security Team :
http://www.hamid.ir/tools/
want to know more ?
http://www.hamid.ir/paper
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
[ reply ]