Secunia Research has discovered a vulnerability in various HAURI anti-virus products, which can be exploited by malicious people to write files to arbitrary directories.

The vulnerability is caused due to unsafe extraction of compressed archives (e.g. ACE, ARJ, CAB, LZH, RAR, TAR, and ZIP) into a temporary directory before scanning. This can be exploited to write files into arbitrary directories when scanning a malicious archive containing files that have "/../" or "../../" directory sequences in their filenames.

Successful exploitation allows writing of files to arbitrary directories, which can potentially lead to code execution (e.g. by overwriting certain startup files), but requires that compressed file scanning is enabled.

The vulnerability has been confirmed in the following products when scanning some or all of the archive types.
* ViRobot Expert 4.0
* ViRobot Advanced Server
* ViRobot Linux Server 2.0
* HAURI LiveCall

Solution
Apply patches.
Further details available in Customer Area

Provided and/or discovered by
Tan Chew Keong, Secunia Research.

Changelog
Further details available in Customer Area

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2005-24/advisory/

HAURI:
http://www.globalhauri.com/html/download/down_unixpatch.html

Deep Links
Links available in Customer Area