|Main Archive Page > Month Archives > bugtraq archives|
Name : X-Diesel Unreal Commander v0.92 (build 573) multiple
Class : Local/Remote multiple directory traversal (Input Validation Error) Threat level : HIGH Discovered : 2007-08-09 Published : 2007-08-23 Credit : Gynvael Coldwind Vulnerable : 0.92 (build 573), 0.92 (build 565), prior also may be affected
Unreal Commander is an award winning freeware file manager for Windows 98/ME/2000/XP/2003/Vista. The application support multiple archive formats, has a built-in ftp client, and other features.
Unreal Commander fails to check user-supplied input while processing ZIP and RAR archives. A malformed ZIP or RAR file can be used to perform a directory traversal attack and place malware files in a location selected by the attacker. Successful exploitation can lead to a full compromitation of the system.
If the user upacks such an archive, the Unreal Commander will create the file ws2_32.dll in the specified directory, instead of the directory where the user wants to extract it. This may lead to system compromitation, especially if the user executes Unreal Commander with admin privileges.
2. ZIP name spoofing
A ZIP archive contains two places where a file's name is written: Local file header and Central Directory. Unreal Commander displays the file name according to the Central Directory, but extracts the file with the name from the Local File Header. This is may misinform the user about the files contained in the archive. This can help an attacker to trick the user into extracting a dangerous file (for example, an .ani file on an unpacked Windows).
3. ZIP file size heap information leak
If the ZIP has a malformed file size in the file header, then Unreal Commander writes to the file data from the heap. This could allow potential information leak (ftp passwords ?), but this has not been confirmed.
4. RAR directory traversal
Like point 1, but regarding to RAR format.
The vendor has been informed, but has not yet released a proper patch.
The solution is to check if a RAR or ZIP file contains ".." in the names of the files in the archives. It is also advised not to run Unreal Commander with administrative privileges.
Permission is hereby granted to redistribute this advisory, providing that no changes are made and that the copyright notices and disclaimers remain intact.
Copyright (C) 2007 Hispasec Sistemas. -- Gynvael Coldwind mailto: firstname.lastname@example.org mailto: email@example.com