Rarlab WinRar up to 5.59 Archive out-of-bounds write

Summaryinfo

A vulnerability was found in Rarlab WinRar up to 5.59. It has been rated as critical. This vulnerability affects unknown code of the component Archive Handler. This manipulation causes out-of-bounds write. This vulnerability is tracked as CVE-2018-20253. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Rarlab WinRar up to 5.59 (File Compression Software) and classified as critical. Affected by this vulnerability is an unknown function of the component Archive Handler. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. The CWE definition for the vulnerability is CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

In WinRAR versions prior to and including 5.60, There is an out-of-bounds write vulnerability during parsing of a crafted LHA / LZH archive formats. Successful exploitation could lead to arbitrary code execution in the context of the current user.

The bug was discovered 02/05/2019. The weakness was disclosed 02/13/2019. This vulnerability is known as CVE-2018-20253 since 12/19/2018. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 8 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 371635 (WinRAR Arbitrary Code Execution Vulnerability).

Upgrading to version 5.60 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 106948†). The entries VDB-130547, VDB-130548 and VDB-130549 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• File Compression Software

Vendor

• Rarlab

Name

• WinRar

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10
• 5.11
• 5.12
• 5.13
• 5.14
• 5.15
• 5.16
• 5.17
• 5.18
• 5.19
• 5.20
• 5.21
• 5.22
• 5.23
• 5.24
• 5.25
• 5.26
• 5.27
• 5.28
• 5.29
• 5.30
• 5.31
• 5.32
• 5.33
• 5.34
• 5.35
• 5.36
• 5.37
• 5.38
• 5.39
• 5.40
• 5.41
• 5.42
• 5.43
• 5.44
• 5.45
• 5.46
• 5.47
• 5.48
• 5.49
• 5.50
• 5.51
• 5.52
• 5.53
• 5.54
• 5.55
• 5.56
• 5.57
• 5.58
• 5.59

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion