[NT] PowerArchiver DZIPS32.DLL Buffer Overflow



The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



PowerArchiver DZIPS32.DLL Buffer Overflow
------------------------------------------------------------------------


SUMMARY

<http://www.powerarchiver.com/pacl/> PACL is "an advanced command line
archiving utility for Windows console environments. It fully supports a
variety of the most popular compressed file formats, including: ZIP, CAB,
JAR, TAR, TAR.GZ, TAR.BZ2, yENC, Base64, CAB SFX and many others. PACL
also includes 5 different encryption methods". A vulnerability has been
found in PowerArchiver. When exploited, the vulnerability allows execution
of arbitrary code when the user adds a file to a malicious ZIP archive.

DETAILS

Vulnerable Systems:
* PowerArchiver version 9.62.03

Immune Systems:
* PowerArchiver version 9.63

This advisory discloses a buffer overflow vulnerability in PowerArchiver.
The stack-based buffer overflow occurs when PowerArchiver is attempting to
add a file to a ZIP archive that contains a file with an overly long
filename. It is possible to exploit the buffer overflow to execute
arbitrary code.

In order to exploit this vulnerability successfully, the user must be
convinced to open a malicious ZIP archive and to add a file to the
archive.

The buffer overflow occurs in DZIPS32.DLL (version 6.0.0.4) that is
distributed with PowerArchiver.

The buffer overflow occurs in a function that resembles the following in
DZIPS32.DLL.

func_20009B20(arg_0, arg_4, arg_8)
{
DWORD var1;
DWORD var2;
DWORD var3;
DWORD var4;
DWORD var5;
DWORD var6;
DWORD var7;
DWORD var8;
DWORD var9;
DWORD var10;
DWORD var11;
DWORD nNumberOfBytesToWrite;
DWORD bytesWritten;
char buffer[0x800]; // 2048 bytes

...
var1 = 0;
var2 = 0;
var3 = 0;
var9 = 0;
var11 = 0;

// Both cases will cause buffer overflow in "buffer"
// when filename of compressed file is > 2048 bytes

if(arg_8->someFlag == 0)
CharToOemA(arg_0->NameOfCompressedFile, buffer);
else
lstrcpyA(buffer, arg_0->NameOfCompressedFile);
...
...
...
}

Disclosure Timeline:
2006-07-08 - Vulnerability Discovered.
2006-07-17 - Initial Vendor Notification.
2006-07-25 - Vendor Released Fixed Version.
2006-07-25 - Public Release.


ADDITIONAL INFORMATION

The information has been provided by <mailto:chewkeong@xxxxxxx> Tan Chew
Keong.
The original article can be found at: <http://vuln.sg/powarc962-en.html>
http://vuln.sg/powarc962-en.html



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • [NT] Computer Associates BrightStor ARCserve Backup Buffer Overflow Vulnerability (6502)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... vulnerability in one of CA's BrightStor ARCserve services allows remote ... This specific flaw requires the Message Log Level to be set to either ... +04h DWORD ...
    (Securiteam)
  • [NT] PowerArchiver ACE and ARJ Archive Handling Buffer Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A vulnerability within PowerArchiver allows attackers to cause the program ... 20/09/2005 - Vendor provided fixed version for testing ...
    (Securiteam)
  • [EXPL] WinPcap NPF.SYS Privilege Elevation Vulnerability (PoC exploit)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WinPcap NPF.SYS Privilege Elevation Vulnerability ... Windows 2003 Server ... typedef DWORD (LPVOID ImageBase, ...
    (Securiteam)
  • [NEWS] McAfee ePolicy Orchestrator Remote Compromise
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... request, UUID, and computer hostname. ... The data that follows first specifies a directory and xml filename, ... +06h DWORD file offset of XML ...
    (Securiteam)
  • [EXPL] Windows Compressed Zip File Exploit Code (MS04-034)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WORD CompressionMethod; ... DWORD UncompressedSize; ... WORD FilenameLength; ...
    (Securiteam)