WinISO and others Directory Traversal

2006.05.02
Credit: Sowhat
Risk: Medium
Local: No
Remote: Yes
CWE: N/A

WinISO/UltraISO/MagicISO/PowerISO Directory Traversal Vulnerability By Sowhat of Nevis Labs Date: 2006.04.28 http://www.nevisnetworks.com http://secway.org/advisory/AD20060428.txt CVE: N/A Vendor WinISO Computing Inc. EZB Systems, Inc. MagicISO Inc. PowerISO Computing, Inc. Affected Software WinISO 5.3 UltraISO V8.0.0.1392 Magic ISO 5.0 Build 0166 PowerISO v2.9 Rating: Moderately critical ( 4 * Less Critical :) Overview: WinISO/UltraISO/PowerISO/MagicISO are the 4 most popular software to edit BIN/ISO or almost all images file(s) directly! It can process almost all CD-ROM image file(s) including ISO and BINs. There is a vulnerability exists in WinISO and UltraISO, which potentially can be exploited by malicious people to compromise a user's system. Description: The vulnerability is caused due to an input validation error when extracting an ISO archive. This makes it possible to have files extracted to arbitrary locations outside the specified directory using the "../" directory traversal sequence. The vulnerability has been confirmed in version WinISO 5.3,UltraISO V8.0.0.1392, PowerISO v2.9,Magic ISO 5.0 Build 0166 Other versions may also be affected. POC: http://secway.org/exploit/PoC.iso.bin Rename the PoC.iso.bin to Poc.iso, Extracting the PoC.iso from C driver will write a "POC" file in your startup folder. FIX: Please check the vendor's website for update. PowerISO: "We will fixed this bug in the next released version. In the version, we will check file name before extract. If such file is detected, the path name will be removed from the file name, and the program will allow user to choose whether this file can be extracted" "Following is the registration code for you as our gift. We think this may let you to use all features of PowerISO. User Name : Sowhat Registration Code : ........" When will Microsoft give a Windows XP license for the researchers who ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ reported a critical MS bugz for gift? :) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ UltraISO: "Thanks for your message and the sample ISO image. We will check it and try to fix any bugs related to this issue soon." UltraISO fixed this vulnerability in 1 hour, but they didnt release a new version, because "In general, we do not change version number for minor changes. This bug fix will be included in next file update soon." MagicISO: "Oops. Yes, we confirm this problem. Thank you for your report and sorry for our mistake. We will fix this problem in next build asap." WinISO: Cannot be reached because of their Mail SYSTEM problems,I have tried GMAIL and Hotmail over 10 times, "Delivery to the following recipient failed permanently: support (at) winiso (dot) com [email concealed]" "Delivery to the following recipient failed permanently: info (at) winiso (dot) com [email concealed]" Vendor Response: 2006.04.18 4 Vendors notified via support (at) xxxxx (dot) com [email concealed] 2006.04.18 3 of 4 Vendors responded 2006.04.28 Advisory released -- Sowhat http://secway.org "Life is like a bug, Do you know how to exploit it ?"


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top