HISPASEC Security Advisory http://blog.hispasec.com/lab/
Name : X-Diesel Unreal Commander v0.92 (build 573) multiple vulnerabilities Class : Local/Remote multiple directory traversal (Input Validation Error) Threat level : HIGH Discovered : 2007-08-09 Published : 2007-08-23 Credit : Gynvael Coldwind Vulnerable : 0.92 (build 573), 0.92 (build 565), prior also may be affected
== Abstract ==
Unreal Commander is an award winning freeware file manager for Windows 98/ME/2000/XP/2003/Vista. The application support multiple archive formats, has a built-in ftp client, and other features.
Unreal Commander fails to check user-supplied input while processing ZIP and RAR archives. A malformed ZIP or RAR file can be used to perform a directory traversal attack and place malware files in a location selected by the attacker. Successful exploitation can lead to a full compromitation of the system.
== Details ==
If the user upacks such an archive, the Unreal Commander will create the file ws2_32.dll in the specified directory, instead of the directory where the user wants to extract it. This may lead to system compromitation, especially if the user executes Unreal Commander with admin privileges.
ZIP file size heap information leak If the ZIP has a malformed file size in the file header, then Unreal Commander writes to the file data from the heap. This could allow potential information leak (ftp passwords ?), but this has not been confirmed.
RAR directory traversal Like point 1, but regarding to RAR format.
== Vendor status and solution ==
The vendor has been informed, but has not yet released a proper patch.
The solution is to check if a RAR or ZIP file contains ".." in the names of the files in the archives. It is also advised not to run Unreal Commander with administrative privileges.
== Disclaimer == This document and all the information it contains is provided "as is", without any warranty. Hispasec Sistemas is not responsible for the misuse of the information provided in this advisory. The advisory is provided for educational purposes only.
Permission is hereby granted to redistribute this advisory, providing that no changes are made and that the copyright notices and disclaimers remain intact.
Copyright (C) 2007 Hispasec Sistemas.
-- Gynvael Coldwind mailto: email@example.com mailto: firstname.lastname@example.org