archivexpert Archive Extraction Directory traversal
Complete built-in support (including creating archives and adding files)
for ZIP, CAB, LHA, LZH, TAR, JAR, GZ and BH (BlakHole) files,
and built-in support for reading and extracting many other file formats:
ACE (including new ACE v2 format), ARC, ARJ, ENC, HA, PAK, PK3, PK_, RAR, TGZ, Z and ZOO

http://www.archivexpert.com

Credit:
The information has been provided by Hamid Ebadi

The original article can be found at : http://www.bugtraq.ir
http://www.bugtraq.ir/articles/advisory/archivexpert_directory_traversal/8

Vulnerable Systems:
archivexpert Version 2.02 build 80

Detail :

The vulnerability is caused due to an input validation error when extracting files compressed with
GZ (.gz) ,JAR (.jar), RAR (.rar), TAR.GZ (.tar.gz),ZIP (.zip),TAR (.tar)
This makes it possible to have files extracted to arbitrary locations outside the specified directory (like StartUp) using the "../" directory traversal sequence.

Solution:
Do not extract untrusted archives.
To reduce the risk, never extract files as an administrative user.

harmless exploit:
use HEAP : http://www.hamid.ir/tools/

# copyright : http://www.bugtraq.ir