RARLab’s WinRAR
Local Stack Overflow
04-July-2006

Summary
WinRAR is an archive manager that supports a diverse range of formats. This
list of formats includes RAR, ZIP, CAB, ARJ, LZH, TAR, GZ, BZ2, ACE, UUE,JAR, ISO, 7Zip, and Z.
While processing LHA files, WinRAR concatenates the directory-name and thefilename portions of an archive. Due to a lack of constraints while copying data,
two stack-buffer overflows can result.

Impact
These vulnerabilities are present by default in WinRAR. An attacker would needto convince a WinRAR user to open a specially crafted file. This file can haveany extension as long as WinRAR is configured to process it. Successful
exploitation of these vulnerabilities results in code execution with the fullprivileges of the current user. Since these exploits are stack based, and due tospecific code constructs, exploitation can be made reliable.

Affected software
WinRAR – At least versions less-than 3.60 beta 7 and greater-than 3.0, althoughothers may be affected as wellCredit
These vulnerabilities were researched by Ryan Smith.

Contact
advisories@hustlelabs.com

Page 1 of 5

Details
The following code processes LHA extended-headers. For level-1 LHA headers,the code reads in extra data from a file. The code then executes a switch
statement to jump to a location that handles the specific extended-header type.

Here the code reads in extended-headers of the filename type. The code reads
filename sizes of up-to 0xFC bytes and stores this user-supplied data into theszFilename buffer.

Page 2 of 5

The code in the following image is responsible for processing LHA extendedheaders of the directory name type. The code will copy a user-supplied buffer up
to 0x3FC bytes in length into the szDName variable.

The next image is the vulnerable portion of the code. The program takes the twouser-supplied values, one up to 0x3FC bytes in length, the other up to 0xFC
bytes in length, and concatenates them into a buffer that is 0x400 bytes in length.
The code then copies the resultant buffer, up to 0x4F8 bytes in length, to theszFileName buffer that is only 0xFF bytes in length. This buffer mismanagement
results in two stack based overflows.

Page 3 of 5

Remediation
The code should either truncate the strings, or allocate more space for thestrings.
Version 3.6 Beta 7 corrects the issue mentioned in this document. This version
should be installed in order to mitigate the vulnerability. If the old version must
be used, it may be possible to copy the lzh.fmt file from the new installer into thecurrent directory. As well, if LHA compression is not needed, the file lzh.fmt may
be removed from the installation directory.

Timeline of Events
04-July-2006 – Advisory draft date
11-July-2006 – Vendor notification
12-July-2006 – Vendor created a patch
13-July-2006 – Vendor released patched version
18-July-2006 – Advisory made publicPage 4 of 5

Attributions
The images of The Muppet Show’s Beaker and Dr. Bunsen were taken fromhttp://www.getbert.com, http://www.forskning.no and http://newsimg.bbc.co.uk.
Code and cross-reference screenshots captured using IDA(http://www.datarescue.com).
Flawed code obtained from RARLabs (http://www.rarlab.com).
The Creative Commons license-notification image borrowed fromhttp://www.creativecommons.org.

LicenseThis work is licensed under the Creative Commons Attribution 2.5 License. Toview a copy of this license, visit http://creativecommons.org/licenses/by/2.5/ orsend a letter to Creative Commons, 543 Howard Street, 5th Floor, SanFrancisco, California, 94105, USA.
Attribution should be provided both in the form of a link or reference tohttp://www.hustlelabs.com and a copy of the researchers’ names listed under theCredit section of this document.
All other trademarks and copyrights referenced in this document are the propertyof their respective owners.

Page 5 of 5