WinArchiver 3.2 SEH Buffer Overflow Vulnerability

Title: SEH BUFFER OVERFLOW IN WINARCHIVER V.3.2
  Severity: Critical
  History: 24.Apr.2013 Vulnerability reported
  Authors: Josep Pi Rodriguez, Pedro Guillen Nuñez , Miguel Angel de Castro Simon
  Organization: RealPentesting
  URL: http://www.realpentesting.blogspot.com
  Product: WinArchiver
  Version: 3.2
  Vendor: PowerSoftware
  Url Vendor: http://winarchiver.com
  Platform: Windows
  Type of vulnerability: SEH buffer overflow
  Issue fixed in version: (Not fixed)
  CVE identifier: CVE-2013-5660

[ DESCRIPTION SOFTWARE ]

From vendor website:
WinArchiver is a powerful archive utility, which can open, create, and manage archive files. It supports almost all archive formats, including zip, rar, 7z, iso, and other popular formats. WinArchiver can also mount the archive to a virtual drive without extraction.

[ VULNERABILITY DETAILS ]

WinArchiver suffers from a SEH based overflow
Above you can see the debugged process after the seh overflow. As you can see in the bold letters the structure exception handler (seh) has overwritten by 00410041 which is manipulated by us. The proof of concept .zip file is attached in this mail. You have to open the .zip with WinArchiver and click the extract button in order to trigger the vulnerability.

Registers
---------
eax=00000041 ebx=000017a6 ecx=043b0000 edx=7fffdf41 esi=043aed84 edi=043aed58
eip=004e64cb esp=043ae8cc ebp=043ae8d0 iopl=0         nv up ei pl nz ac po cy
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010213
*** ERROR: Module load completed but symbols could not be loaded for C:\Archivos de Programa\WinArchiver\WinArchiver.exe
WinArchiver+0xe64cb:
004e64cb 668901          mov     word ptr [ecx],ax        ds:0023:043b0000=????
Seh chain
----------
!exchain
043aff0c: WinArchiver+10041 (00410041)
Invalid exception stack at 00410041

By opening a specially crafted zip file, it is possible to execute arbitrary code.We can sucesfully exploit the vulnerability in order to gain code execution.

[ VENDOR COMMUNICATION ]

20/04/2013 : vendor contacted.No response
24/04/2013 : vendor contacted again.No response
29/04/2013:  PUBLIC DISCLOSURE

#  0day.today [2018-02-19]  #