====================================================================== Secunia Research 19/08/2005 - HAURI Anti-Virus Compressed Archive Directory Traversal - ====================================================================== Table of Contents Affected Software....................................................1 Severity.............................................................2 Description of Vulnerability.........................................3 Solution.............................................................4 Time Table...........................................................5 Credits..............................................................6 References...........................................................7 About Secunia........................................................8 Verification.........................................................9 ====================================================================== 1) Affected Software ViRobot Expert 4.0 ViRobot Advanced Server ViRobot Linux Server 2.0 HAURI LiveCall Other versions may also be affected. ====================================================================== 2) Severity Rating: Moderately critical Impact: Security Bypass Where: Remote ====================================================================== 3) Description of Vulnerability Secunia Research has discovered a vulnerability in various HAURI anti-virus products, which can be exploited by malicious people to write files to arbitrary directories. The vulnerability is caused due to unsafe extraction of compressed archives (e.g. ACE, ARJ, CAB, LZH, RAR, TAR and ZIP) into a temporary directory before scanning. This can be exploited to write files into arbitrary directories when scanning a malicious archive containing files that have "/../" or "../../" directory sequences in their filenames. Successful exploitation allows writing of files to arbitrary directories, which can potentially lead to code execution (e.g. by overwriting certain startup files), but requires that compressed file scanning is enabled. ====================================================================== 4) Solution Apply patches. ViRobot Linux Server 2.0: http://www.globalhauri.com/html/download/down_unixpatch.html ViRobot Expert 4.0 / ViRobot Advanced Server / LiveCall: Updated version available via online update is still vulnerable when scanning certain archive types. Disable compressed file scanning and scan files only after they have been confirmed not to contain directory traversal sequences in their filenames and correctly extracted. ====================================================================== 5) Time Table 30/06/2005 - Initial vendor notification. 12/07/2005 - Second vendor notification. 14/07/2005 - Vendor response. 08/08/2005 - Received notification that VR Expert and VR Advanced Server has been fixed via online update. 09/08/2005 - Received notification that LiveCall has been fixed via online update. 11/08/2005 - Notified vendor that certain archive types are still affected. 17/08/2005 - Vendor released patch for VR Linux Server and disclosed vulnerability information. 19/08/2005 - Public disclosure. ====================================================================== 6) Credits Discovered by Tan Chew Keong, Secunia Research. ====================================================================== 7) References HAURI: http://www.globalhauri.com/html/download/down_unixpatch.html ====================================================================== 8) About Secunia Secunia collects, validates, assesses, and writes advisories regarding all the latest software vulnerabilities disclosed to the public. These advisories are gathered in a publicly available database at the Secunia website: http://secunia.com/ Secunia offers services to our customers enabling them to receive all relevant vulnerability information to their specific system configuration. Secunia offers a FREE mailing list called Secunia Security Advisories: http://secunia.com/secunia_security_advisories/ ====================================================================== 9) Verification Please verify this advisory by visiting the Secunia website: http://secunia.com/secunia_research/2005-24/advisory/ Complete list of vulnerability reports published by Secunia Research: http://secunia.com/secunia_research/ ======================================================================