From: Secunia Security Advisories (sec-advsecunia.com)
Date: Fri Aug 19 2005 - 07:49:10 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

----------------------------------------------------------------------

Bist Du interessiert an einem neuen Job in IT-Sicherheit?

Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
HAURI Anti-Virus Compressed Archive Directory Traversal

SECUNIA ADVISORY ID:
SA15846

VERIFY ADVISORY:
http://secunia.com/advisories/15846/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass

WHERE:
From remote

SOFTWARE:
ViRobot Expert 4.x
http://secunia.com/product/5557/
ViRobot Advanced Server
http://secunia.com/product/5556/
HAURI LiveCall
http://secunia.com/product/5448/
ViRobot Linux Server 2.x
http://secunia.com/product/2048/

DESCRIPTION:
Secunia Research has discovered a vulnerability in various HAURI
anti-virus products, which can be exploited by malicious people to
write files to arbitrary directories.

The vulnerability is caused due to unsafe extraction of compressed
archives (e.g. ACE, ARJ, CAB, LZH, RAR, TAR, and ZIP) into a
temporary directory before scanning. This can be exploited to write
files into arbitrary directories when scanning a malicious archive
containing files that have "/../" or "../../" directory sequences in
their filenames.

Successful exploitation allows writing of files to arbitrary
directories, which can potentially lead to code execution (e.g. by
overwriting certain startup files), but requires that compressed file
scanning is enabled.

The vulnerability has been confirmed in the following products when
scanning some or all of the archive types.
* ViRobot Expert 4.0
* ViRobot Advanced Server
* ViRobot Linux Server 2.0
* HAURI LiveCall

SOLUTION:
Apply patches.

ViRobot Linux Server 2.0:
http://www.globalhauri.com/html/download/down_unixpatch.html

ViRobot Expert 4.0 / ViRobot Advanced Server / LiveCall:
Updated version obtained available via online update is still
vulnerable when scanning certain archive types.

Disable compressed file scanning. Instead scan files after they have
been extracted and confirmed not to contain directory traversal
sequences in their filenames.

PROVIDED AND/OR DISCOVERED BY:
Tan Chew Keong, Secunia Research.

ORIGINAL ADVISORY:
Secunia Research:
http://secunia.com/secunia_research/2005-24/advisory/

HAURI:
http://www.globalhauri.com/html/download/down_unixpatch.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]