<<< Date Index >>>     <<< Thread Index >>>

WinHKI 1.6x Archive Extraction Directory traversal

WinHKI 1.6x Archive Extraction Directory traversal 
WinHKI Archiver administrator ask me for penetration
test. here is the result :

WinHKI Archiver: compression (hki, cab, zip, gzip,
tar, jar...) 
extract 14 formats (hki, rar, ace, zip, gzip, tar,
...) 
Encryption / Decryption support 
Full zip support ,own HKI format ,splitten and
spanning ,SFX Modul ,12 Languages

http://www.winhki.com
http://www.webtoolmaster.com

Credit:
The information has been provided by Hamid Ebadi
( Hamid Network Security Team) : admin@xxxxxxxxx
The original article can be found at :
http://hamid.ir/security

Vulnerable Systems:
WinHKI 1.6 and Below

Detail :

The vulnerability is caused due to an input validation
error when extracting files compressed with RAR (.rar)
or TAR (.tar) or  ZIP (.zip) or TAR.GZ (tar.gz)
This makes it possible to have files extracted to
arbitrary locations outside the specified directory
using the "../" directory traversal sequence.


Solution:
resolved issue and fix will be available in next
release .

Do not extract untrusted  RAR and TAR and ZIP and
TAR.GZ files.
To reduce the risk, never extract files as an
administrative user.

harmless exploit:
use HEAP [Hamid Evil Archive Pack]
you can download it from Hamid Network Security Team :

http://www.hamid.ir/tools/


want to know more ?
http://www.hamid.ir/paper


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com