In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html | Exploit Third Party Advisory VDB Entry |
| http://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_ace | Third Party Advisory |
| http://www.securityfocus.com/bid/106948 | Broken Link Third Party Advisory VDB Entry |
| https://github.com/blau72/CVE-2018-20250-WinRAR-ACE | Exploit Third Party Advisory |
| https://research.checkpoint.com/extracting-code-execution-from-winrar/ | Exploit Press/Media Coverage Third Party Advisory |
| https://www.exploit-db.com/exploits/46552/ | Exploit VDB Entry Third Party Advisory |
| https://www.exploit-db.com/exploits/46756/ | Exploit VDB Entry Third Party Advisory |
| https://www.win-rar.com/whatsnew.html | Release Notes |
Configurations
History
24 Jul 2024, 16:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/152618/RARLAB-WinRAR-ACE-Format-Input-Validation-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () http://www.securityfocus.com/bid/106948 - Broken Link, Third Party Advisory, VDB Entry | |
| References | () https://research.checkpoint.com/extracting-code-execution-from-winrar/ - Exploit, Press/Media Coverage, Third Party Advisory | |
| References | () https://www.win-rar.com/whatsnew.html - Release Notes |
Information
Published : 2019-02-05 20:29
Updated : 2024-07-24 16:05
NVD link : CVE-2018-20250
Mitre link : CVE-2018-20250
CVE.ORG link : CVE-2018-20250
JSON object : View
Products Affected
rarlab
- winrar