A vulnerability, which was classified as critical, was found in Rarlab WinRar (File Compression Software). Affected is the function validator in the library UNACEV2.dll of the component ACE Archive Handler. The manipulation of the argument filename as part of a Return Value leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A validation function (in WinRAR code) is being called before extraction of ACE archives. The validation function inspects the filename field for each compressed file in the ACE archive. In case the filename is disallow by the validator function (for example, the filename contains path traversal patterns) The extraction operation should be aborted and no file or folder should be extracted. However, the check of the return value from the validator function made too late (in UNACEV2.dll), after the creation of files and folders. It prevent the write operation to the extracted files only.

The bug was discovered 02/05/2019. The weakness was presented 02/05/2019 (Website). The advisory is shared for download at securityfocus.com. This vulnerability is traded as CVE-2018-20251 since 12/19/2018. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 371635 (WinRAR Arbitrary Code Execution Vulnerability).

Upgrading to version 5.70 beta 1 eliminates this vulnerability.

See 130547, 130549 and 130837 for similar entries.

Productinfo

Type

• File Compression Software

Vendor

• Rarlab

Name

• WinRar

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion