Directory traversal vulnerabilities in several archivers processing .tar

[Florian Schafferhans <fs () computer-security de>]

Subject

  Directory traversal vulnerabilities in several
archivers processing .tar
 files



Author

  Florian "sticky bit" Schafferhans
   <fs () computer-security de>
   http://www.computer-security.de/



Date

  17. December 2002



Affected

 GNU cpio 2.5
  http://www.gnu.org/
  tested on Linux 2.2.19

 Winzip Computing WinZip 8.1
  http://www.winzip.com/
  evaluation copy tested on Windows 98 SE

 PKWARE PKZip 5.00.01
  http://www.pkzip.com/
  evaluation copy tested on Windows 98 SE

 Aladdin Systems (former Ontrack) ZipMagic 4.0
  http://www.aladdinsys.com/
  evaluation copy tested on Windows 98 SE

 Eugene Roshal's WinRAR 3.00
  http://www.rarlabs.com/
  evaluation copy tested on Windows 98 SE

 Speedproject Squeez 4.0
  http://www.speedproject.de/
  evaluation copy tested on Windows 98 SE

 Speedproject Squeez 4.1
  http://www.speedproject.de/
  evaluation copy tested on Windows 98 SE

 Speedproject SpeedCommander 8.1
  http://www.speedproject.de/
  evaluation copy tested on Windows 98 SE

 Speedproject SpeedCommander 9.0
  http://www.speedproject.de/
  evaluation copy tested on Windows 98 SE



Summary

  The .tar file format is widely used on UNIX(-like)
able to stores almost
any information, such as name, owner, mode, etc., of
several files
including their content and sum them up in one file
originally to be stored
on tapes for backups e. g.. It is also commonly used to
get a bunch of
files together and compress them afterwards with common
compression
programs such as gzip, as the .gz e. g. doesn't support
the summary of
several files, e. g. to transfer file sets through
networks with less
overhead and more comfort. Note that the .tar file
format itself doesn't
support any compression at all.
  Several programs capable of processing .tar files are
vulnerable to
directory traversals under certain circumstances. This
may result in
overwritten files, in the best case, in smuggled in
malware in the worst.



Details

  The .tar file format works in record blocks usually
of 512 bytes sizes.
for each file in the archive there is a header record
in which attributes
like the file's name, mode, size, type, the file
owner's uid, gid, uname,
gname and several other information. If necessary the
following records
store the file's content.
  Several programs do not handle the file's path,
stored in the first 100
bytes in plain ASCII and filled up with NULL-bytes if
necessary of such a
header record block carefully enough. If a path's
string contains a leading
slash ('/') most programs strip them off by default
when unpacking an
archive (even if providing to leave it e. g. if
restoring a system after a
backup this could be useful) to avoid files to be
overwritten by accident.
But they don't check and remove directory up strings
('../') but open
directly the given path, without any warning. This way
it would be possible
to place anywhere in the system, e. g. overwriting a
binary of a server
software which contains a back door to gain system
access in a further
step or just leave crap anywhere in the system it's all
up in guessing the
right
path and be lucky that  the unpacking software doesn't
show what's going
on or the user not note it properly.
  The circumstance that unpacking .tar files is often
the first action when
 installing new software and one's logged in as super
user therefore to have
 the proper privileges make things even worse.
  Note that a dot-dot-backslash ('..\') will have the
same effect on a
Windows system.

  The following gives a description how the
circumstances the affected
programs are vulnerable in detail:

   GNU cpio 2.5
     This software is fully affected.

   Winzip Computing WinZip 8.1
     When the option "Extract folder names" in the
extract dialogue is
    checked (usually one will use this, otherwise the
hole directory
    structure would be lost, resulting in an
unorganized bunch of files)
    the software behaves behaves exactly as described
above. The
    option is checked by default so also an extraction
over the
    context menu of a file linked to this software (the
menu popping
    up when right clicking a file's icon in Windows) is
an action
    affected.

   PKWARE PKZip 5.00.01
     This software is fully affected.

   Aladdin Systems (former Ontrack) ZipMagic 4.0
     This software is fully affected.

   Eugene Roshal's WinRAR 3.00
     This software is not affected in the way described
above. It just
    leaves out any '../' found in a path when
extracting .tar files.
     The only problem that remains is the display. This
program shows an
    archive's content similar like most GUIs all files
represented by icons,
    pretending the archive would be just a normal
directory.
     All folders of an archive (also the ones not
mentioned explicitly but
    resulting to the paths of contained files) are
displayed as folder
    icons. There is one special folder displayed named
'..' which will
    lead into the folder the archive lays in, then it's
possible to browse
    this folder or even the whole file system through
the software, or
    let's you get one level up if you are in a folder
of the archive.
     Unfortunately a '../' in an archives file name
header record will also
    be shown as a folder named '..' and lead exactly to
the same like
    the '..' folder of the software itself. A user so
might assume just an
    error of the software not being aware that the
archive might contain
    files not seen or even directory traversal paths.
So he might
    distribute archives which contains potential
dangers (when then
    extracted with other programs) without even having
the chance to know
    about.

   Speedproject Squeez 4.0
     This software is not affected in the way described
above. It will
    replace any '../' with a '___' when extracting .tar
files.
     Unfortunately it also replaces any '../' in the
display with a '___'.
    So users might not be aware of the circumstance
that the archives
    contains directory traversal paths and might so
distribute archives
    containing potential dangers he has no chance to
know about.

   Speedproject Squeez 4.1
     This software is not affected in the way described
above. It will
    ignore any '../' when extracting .tar files, just
leaving this part of
    the path away.
     Unfortunately it also ignores it in the display so
doesn't display a
    '../' part in a path. So users might not be aware
of the circumstance
    that the archives contains directory traversal
paths and might so
    distribute archives containing potential dangers he
has no chance to
    know about.

   Speedproject SpeedCommander 8.1
     This software is not affected in the way described
above. It will
    replace any '../' with a '___' when extracting .tar
files.
     Unfortunately it also replaces any '../' in the
display with a '___'.
    So users might not be aware of the circumstance
that the archives
    contains directory traversal paths and might so
distribute archives
    containing potential dangers he has no chance to
know about.

   Speedproject SpeedCommander 9.0
     This software is not affected in the way described
above. It will
    ignore any '../' when extracting .tar files, just
leaving this part of
    the path away.
     Unfortunately it also ignores it in the display so
doesn't display a
    '../' part in a path. So users might not be aware
of the circumstance
    that the archives contains directory traversal
paths and might so
    distribute archives containing potential dangers he
has no chance
    to know about.



Solution

   GNU cpio 2.5
     As a work-around you could use the -t or --list
switch to show the
    archive's content and check carefully for '../' or
perform something
    like cpio -t -F file.tar 2> /dev/null | grep
"\.\./" to automate it.
     I have not received any information when an update
fixing this issue
    will be available.

   Winzip Computing WinZip 8.1
     An fixing the issues update is available under
    http://www.winzip.com/wz81sr1.htm.

   PKWARE PKZip 5.00.01
     Open every archive and check paths carefully. Do
not extract out of
    the Windows context menu (right click on a file's
icon).
     I have not received any information when an update
fixing this issue
    will be available.

   Aladdin Systems (former Ontrack) ZipMagic 4.0
     Open every archive and check paths carefully. Do
not extract out of
    the Windows context menu (right click on a file's
icon).
     I have not received any information when an update
fixing this issue
    will be available.

   Eugene Roshal's WinRAR 3.00
     Be suspicious when you see the '..' folder icon
twice in an archive.
    There's already a new version released fixing this
issue,
    WinRAR 3.10 beta 3. It is available under
http://www.rarlabs.com/.

   Speedproject Squeez 4.0
     Be suspicious when you see a folder named '___' in
an archive.
     There is already an new release available under
    http://www.speedproject.de/enu/index.html, Squeez
4.1. But
    unfortunately in the new release the problems are
even worse
    (see details section).

   Speedproject Squeez 4.1
     Sorry but it seems to me like there no chance
other than change to an
    other software for now.
     I have not received any information when an update
fixing this issue
    will be available.

   Speedproject SpeedCommander 8.1
     Be suspicious when you see a folder named '___' in
an archive.
     There is already an new release available under
    http://www.speedproject.de/enu/index.html,
SpeedCommander 9.0. But
    unfortunatly in the new release the problems are
even worse
    (see details section).

   Speedproject SpeedCommander 9.0
     Sorry but it seems to me like there no chance
other than change to an
    other software for now.
     I have not received any information when an update
fixing this issue
    will be available.



Related

  Directory traversal and path globing in multiple
archivers
   http://online.securityfocus.com/archive/1/196445
  Special devices access in multiple archivers
   http://online.securityfocus.com/archive/1/196965