HAURItraverse.txt

`======================================================================   
  
Secunia Research 19/08/2005  
  
- HAURI Anti-Virus Compressed Archive Directory Traversal -  
  
======================================================================   
Table of Contents  
  
Affected Software....................................................1  
Severity.............................................................2  
Description of Vulnerability.........................................3  
Solution.............................................................4  
Time Table...........................................................5  
Credits..............................................................6  
References...........................................................7  
About Secunia........................................................8  
Verification.........................................................9  
  
======================================================================   
1) Affected Software   
  
ViRobot Expert 4.0   
ViRobot Advanced Server  
ViRobot Linux Server 2.0  
HAURI LiveCall  
  
Other versions may also be affected.  
  
======================================================================   
2) Severity   
  
Rating: Moderately critical  
Impact: Security Bypass  
Where: Remote  
  
======================================================================   
3) Description of Vulnerability  
  
Secunia Research has discovered a vulnerability in various HAURI  
anti-virus products, which can be exploited by malicious people to  
write files to arbitrary directories.  
  
The vulnerability is caused due to unsafe extraction of compressed  
archives (e.g. ACE, ARJ, CAB, LZH, RAR, TAR and ZIP) into a temporary  
directory before scanning. This can be exploited to write files into  
arbitrary directories when scanning a malicious archive containing   
files that have "/../" or "../../" directory sequences in their   
filenames.  
  
Successful exploitation allows writing of files to arbitrary  
directories, which can potentially lead to code execution (e.g. by  
overwriting certain startup files), but requires that compressed file  
scanning is enabled.  
  
======================================================================   
4) Solution   
  
Apply patches.  
  
ViRobot Linux Server 2.0:  
http://www.globalhauri.com/html/download/down_unixpatch.html   
  
ViRobot Expert 4.0 / ViRobot Advanced Server / LiveCall:  
Updated version available via online update is still vulnerable when   
scanning certain archive types.  
  
Disable compressed file scanning and scan files only after they have  
been confirmed not to contain directory traversal sequences in their  
filenames and correctly extracted.  
  
======================================================================   
5) Time Table   
  
30/06/2005 - Initial vendor notification.  
12/07/2005 - Second vendor notification.  
14/07/2005 - Vendor response.  
08/08/2005 - Received notification that VR Expert and VR Advanced   
Server has been fixed via online update.  
09/08/2005 - Received notification that LiveCall has been fixed via  
online update.  
11/08/2005 - Notified vendor that certain archive types are still  
affected.  
17/08/2005 - Vendor released patch for VR Linux Server and disclosed  
vulnerability information.  
19/08/2005 - Public disclosure.  
  
======================================================================   
6) Credits   
  
Discovered by Tan Chew Keong, Secunia Research.  
  
======================================================================   
7) References  
  
HAURI:  
http://www.globalhauri.com/html/download/down_unixpatch.html  
  
======================================================================   
8) About Secunia   
  
Secunia collects, validates, assesses, and writes advisories regarding   
all the latest software vulnerabilities disclosed to the public. These   
advisories are gathered in a publicly available database at the   
Secunia website:   
  
http://secunia.com/  
  
Secunia offers services to our customers enabling them to receive all   
relevant vulnerability information to their specific system   
configuration.   
  
Secunia offers a FREE mailing list called Secunia Security Advisories:   
  
http://secunia.com/secunia_security_advisories/  
  
======================================================================   
9) Verification   
  
Please verify this advisory by visiting the Secunia website:  
http://secunia.com/secunia_research/2005-24/advisory/  
  
Complete list of vulnerability reports published by Secunia Research:  
http://secunia.com/secunia_research/  
  
======================================================================  
  
`