exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Ark 2.16 Directory Traversal

Ark 2.16 Directory Traversal
Posted Oct 7, 2011
Authored by Tim Brown | Site nth-dimension.org.uk

Ark version 2.16 suffers from a directory traversal vulnerability when handling a malformed ZIP file.

tags | exploit
advisories | CVE-2011-2725
SHA-256 | 65500fe3d0754fdf5656832e5ced430dddaaf1e71169286b94df909c93e51efa

Ark 2.16 Directory Traversal

Change Mirror Download
Hash: SHA256

Nth Dimension Security Advisory (NDSA20110726)
Date: 26th July 2011
Author: Tim Brown <mailto:timb@nth-dimension.org.uk>
URL: <http://www.nth-dimension.org.uk/> / <http://www.machine.org.uk/>
Product: Ark 2.16 <http://utils.kde.org/projects/ark>
Vendor: KDE <http://www.kde.org/>
Risk: Medium


The Ark archiving tool is vulnerable to directory traversal via malformed
Zip files. When attempts are made to view files within the malformed Zip
file in Ark's default view, the wrong file may be displayed due to incorrect
construction of the temporary file name. Whilst this does not allow the
wrong file to be overwritten, after closing the default view, Ark will then
attempt to delete the temporary file which could result in the deletion of
the incorrect file.

After discussions with the vendor, CVE-2011-2725 was assigned to this

Technical Details

Ark is vulnerable to directory traversal in the way it handles temporary
files for rendering when you click view. An archive that has been
manipulated such that it contains files in nested folders with the name
../../../whatever will be opened in the default view as
/temporary/location/../../../whatever. Moreover when the viewer is closed,
QFile::remove will be called on the incorrect location allowing an
arbitrary file to be removed. This can be reproduced using the following

$ echo pwned > $HOME/pwned
$ ls -la $HOME/pwned
$ touch ZZ/ZZ/ZZ/ZZ/ZZ/ZZ/ZZ/ZZ/ZZ/$HOME/pwned
$ zip -r PoC.zip ZZ
$ cat PoC.zip | sed "s/ZZ/../g" > PoC-evil.zip
$ ark PoC-evil.zip

Open the resultant compressed pwned in Ark's default view and you will see
$HOME/pwned instead. To cause this file to be deleted, simply close the view.
This can be verified by checking the existance of the non-compressed pwned
under $HOME:

$ ls -la $HOME/pwned

This is due to:

void Part::slotPreviewExtracted(KJob *job)
// FIXME: the error checking here isn't really working
// if there's an error or an overwrite dialog,
// the preview dialog will be launched anyway
if (!job->error()) {
const ArchiveEntry& entry =
const QString fullName =
m_previewDir->name() + QLatin1Char( '/' ) + entry[ FileName
ArkViewer::view(fullName, widget());
} else {
KMessageBox::error(widget(), job->errorString());

in part.cpp which differs from:

void Part::slotPreview(const QModelIndex & index)
if (!m_previewDir) {
m_previewDir = new KTempDir();

if (!isPreviewable(index)) {

const ArchiveEntry& entry = m_model->entryForIndex(index);

if (!entry.isEmpty()) {
Kerfuffle::ExtractionOptions options;
optione[QLatin1String( "PreservePaths" )] = true;

ExtractJob *job = m_model->extractFile(entry[ InternalID ],
m_previewDir->name(), options);
connect(job, SIGNAL(result(KJob*)),
this, SLOT(slotPreviewExtracted(KJob*)));

It appears that LibArchiveInterface::copyFiles truncates the root node
such that the leading ../../.. get dropped dring the call to the
extractFile method whereas view simply loads m_previewDir->name() +
QLatin1Char( '/' ) + entry[ FileName ].toString().


Nth Dimension recommends that the vendor supplied patches should be applied.


On 29th June 2011, Nth Dimension contacted the KDE security team to
report the described vulnerability.

On 1st July 2011, Jeff Mitchell of KDE confirmed that he had recieved
the report and it had been escalated to Laurent Montel, a KDE developer
working on Ark to determine the impact. Laurent examined the Nth
Dimension supplied test case to understand the the full extent
of the problem.

On 25th July 2011, Jeff Mitchell contacted oss-security on behalf of
the KDE security team to request a CVE for this vulnerability which was
duely assigned. Following the assigment of a CVE for this issue, Nth
Dimension and KDE liased to establish a date for final publication
of the advisory and

At this point Raphael Kubo da Costa of KDE took ownership of the issue.
Raphael and Nth Dimension exchanged a number of emails where various
proposed solutions were discussed before the final patch was agreed on
the 23rd September 2011. At this point it was confirmed that a
coordinated disclosure would occur on the 3rd October 2011.


As of the 4th October 2011, the state of the vulnerabilities is
believed to be as follows. A patch has been developed which it is
successfully mitigates the issue identified. KDE packaging teams
have been notified and vendor specific patches should already be


Nth Dimension would like to thank Laurent, Jeff and Raphael of KDE for
the way they worked to resolve the issue.
Version: GnuPG v1.4.11 (GNU/Linux)

Login or Register to add favorites

File Archive:

May 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    15 Files
  • 2
    May 2nd
    16 Files
  • 3
    May 3rd
    38 Files
  • 4
    May 4th
    15 Files
  • 5
    May 5th
    35 Files
  • 6
    May 6th
    0 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    8 Files
  • 9
    May 9th
    65 Files
  • 10
    May 10th
    19 Files
  • 11
    May 11th
    27 Files
  • 12
    May 12th
    8 Files
  • 13
    May 13th
    0 Files
  • 14
    May 14th
    1 Files
  • 15
    May 15th
    19 Files
  • 16
    May 16th
    66 Files
  • 17
    May 17th
    28 Files
  • 18
    May 18th
    32 Files
  • 19
    May 19th
    13 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    23 Files
  • 23
    May 23rd
    15 Files
  • 24
    May 24th
    49 Files
  • 25
    May 25th
    20 Files
  • 26
    May 26th
    13 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By