Vulnerability Research Advisory

PowerArchiver DZIPS32.DLL Buffer Overflow Vulnerability

by Tan Chew Keong
Release Date: 2006-07-25

   [en] [jp]


A vulnerability has been found in PowerArchiver. When exploited, the vulnerability allows execution of arbitrary code when the user adds a file to a malicious ZIP archive.

Tested Versions

PowerArchiver version 9.62.03 (English)


This advisory discloses a buffer overflow vulnerability in PowerArchiver. The stack-based buffer overflow occurs when PowerArchiver is attempting to add a file to a ZIP archive that contains a file with an overly long filename. It is possible to exploit the buffer overflow to execute arbitrary code.

In order to exploit this vulnerability successfully, the user must be convinced to open a malicious ZIP archive and to add a file to the archive.

The buffer overflow occurs in DZIPS32.DLL (version that is distributed with PowerArchiver.

The buffer overflow occurs in a function that resembles the following in DZIPS32.DLL.

func_20009B20(arg_0, arg_4, arg_8)
	DWORD var1;
	DWORD var2;
	DWORD var3;
	DWORD var4;
	DWORD var5;
	DWORD var6;
	DWORD var7;
	DWORD var8;
	DWORD var9;
	DWORD var10;
	DWORD var11;
	DWORD nNumberOfBytesToWrite;
	DWORD bytesWritten;
	char buffer[0x800];		// 2048 bytes
	var1 = 0;
	var2 = 0;
	var3 = 0;
	var9 = 0;
	var11 = 0;
	// Both cases will cause buffer overflow in "buffer"
	// when filename of compressed file is > 2048 bytes
	if(arg_8->someFlag == 0)
		CharToOemA(arg_0->NameOfCompressedFile, buffer);
		lstrcpyA(buffer, arg_0->NameOfCompressedFile);

POC / Test Code

The following POC ZIP file will exploit the vulnerability in PowerArchiver to execute the harmless calculator (calc.exe). The POC has been successfully tested on English Windows XP SP2.


  1. Run PowerArchiver
  2. Click on the "Open" button or select "File->Open Archive..." from the menu.
  3. Select the POC ZIP file from the File-Open Dialog Box and click "Open".
  4. Click on the "Add" button or select "Actions->Add.." from the menu.
  5. Choose any file in the File-Selection dialog box and click "Add".
  6. Successful exploit will run calculator (calc.exe). Failed exploit will crash PowerArchiver.

Patch / Workaround

Update to version 9.63.

Disclosure Timeline

2006-07-08 - Vulnerability Discovered.
2006-07-17 - Initial Vendor Notification.
2006-07-25 - Vendor Released Fixed Version.
2006-07-25 - Public Release.

For further enquries, comments, suggestions or bug reports, simply email them to