WinHKI 1.6x Archive Extraction Directory traversal
WinHKI Archiver administrator ask me for penetration
test. here is the result :
WinHKI Archiver: compression (hki, cab, zip, gzip,
extract 14 formats (hki, rar, ace, zip, gzip, tar,
Encryption / Decryption support
Full zip support ,own HKI format ,splitten and
spanning ,SFX Modul ,12 Languages
The information has been provided by Hamid Ebadi
( Hamid Network Security Team) : firstname.lastname@example.org.
The original article can be found at :
WinHKI 1.6 and Below
The vulnerability is caused due to an input validation
error when extracting files compressed with RAR (.rar)
or TAR (.tar) or ZIP (.zip) or TAR.GZ (tar.gz)
This makes it possible to have files extracted to
arbitrary locations outside the specified directory
using the "../" directory traversal sequence.
resolved issue and fix will be available in next
Do not extract untrusted RAR and TAR and ZIP and
To reduce the risk, never extract files as an
use HEAP [Hamid Evil Archive Pack]
you can download it from Hamid Network Security Team :
want to know more ?
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around