vuln.sg  

vuln.sg Vulnerability Research Advisory

TurboZIP ZIP Repair Buffer Overflow Vulnerability

by Tan Chew Keong
Release Date: 2006-07-25

   [en] [jp]

Summary

A vulnerability has been found in TurboZIP. When exploited, the vulnerability allows execution of arbitrary code when the user opens and repairs a malicious ZIP archive.


Tested Versions

TurboZIP version 6.0 Build 002021004 (English)


Details

This advisory discloses a buffer overflow vulnerability in TurboZIP. The stack-based buffer overflow occurs when TurboZIP is attempting to repair a ZIP archive that contains a file with an overly long filename. It is possible to exploit the buffer overflow to execute arbitrary code.

In order to exploit this vulnerability successfully, the user must be convinced to open a malicious ZIP file. When such a file is opened, TurboZIP will notify the user that the archive is corrupted and asks whether it should be repaired. The buffer overflow will only occur if the user selects "yes" to repair the archive.

The buffer overflow occurs in DZIP32.DLL (version 5.0.0.4) that is distributed with TurboZIP


The buffer overflow occurs in a function that resembles the following in DZIP32.DLL.


func_20011400(arg_0, arg_4, arg_8)
{
	DWORD var1;
	DWORD var2;
	DWORD bytesWritten;
	char buffer[0x800];		// 2048 bytes
	
	...
	var1 = 0;
	var2 = 0;
	
	// Both cases will cause buffer overflow in "buffer"
	// when filename of compressed file is > 2048 bytes
	
	if(arg_8->someFlag == 0)
		CharToOemA(arg_0->NameOfCompressedFile, buffer);
	else
		lstrcpyA(buffer, arg_0->NameOfCompressedFile);
	...
	...
	...
}
 


POC / Test Code

The following POC ZIP file will exploit the vulnerability in TurboZIP to execute the harmless calculator (calc.exe). The POC has been successfully tested on English Windows XP SP2.


Instructions:

  1. Run TurboZIP
  2. Click on the "Open" button or select "File->Open..." from the menu.
  3. Select the POC ZIP file from the File-Open Dialog Box and click "Open".
  4. TurboZIP will notify you that the archive is invalid and asks whether you want it repaired.
  5. Click on "Yes" to repair it
  6. Successful exploit will run calculator (calc.exe) after about 10 seconds delay. Failed exploit will crash TurboZIP.
 


Patch / Workaround

Update to the version released on 2006-07-23 that contains DZIP32.DLL version 5.0.0.8.

Note: There is no change to the TurboZIP version number.


Disclosure Timeline

2006-07-03 - Vulnerability Discovered.
2006-07-17 - Initial Vendor Notification.
2006-07-23 - Vendor Released Fixed Version.
2006-07-25 - Public Release.


Contact
For further enquries, comments, suggestions or bug reports, simply email them to