[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 18 Aug 2017 16:13:00 +0200
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: Re: ***UNCHECKED*** UnRAR:
directory traversal + memory safety bugs
Quoting from MITRE:
>> There is also a memory overread / corruption issues, are you going to assign
>> more CVEs?
Yes, we looked further and it appears that all of the other issues can
have CVEs.
Specifically, the UnRAR license says "UnRAR source code may be used in
any software to handle RAR archives without limitations free of
charge, but cannot be used to develop RAR (WinRAR) compatible archiver
and to re-create RAR compression algorithm, which is proprietary."
Also, the makefile can be used to build libraries from the code
(libunrar.a, etc.). Therefore, someone might have a long-running
process executing the UnRAR code, and any arbitrary crash
(out-of-bounds read, etc.) could be a denial of service.
Although this scenario may be unlikely, here are the three CVE IDs
anyway.
> [Suggested description]
> libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode
> call within the Archive::ReadHeader15 function.
>
> ------------------------------------------
>
> [Additional Information]
> Someone else might have requested CVEs.
>
> ------------------------------------------
>
> [Vulnerability Type]
> memory safety
>
> ------------------------------------------
>
> [Vendor of Product]
> unrar
>
> ------------------------------------------
>
> [Affected Product Code Base]
> unrar - 5.5.7
>
> ------------------------------------------
>
> [Reference]
> http://seclists.org/oss-sec/2017/q3/290
>
> ------------------------------------------
>
> [Has vendor confirmed or acknowledged the vulnerability?]
> true
Use CVE-2017-12940.
> [Suggested description]
> libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20
> function.
>
> ------------------------------------------
>
> [Additional Information]
> Someone else might have requested CVEs.
>
> ------------------------------------------
>
> [Vulnerability Type]
> memory safety
>
> ------------------------------------------
>
> [Vendor of Product]
> unrar
>
> ------------------------------------------
>
> [Affected Product Code Base]
> unrar - 5.5.7
>
> ------------------------------------------
>
> [Reference]
> http://seclists.org/oss-sec/2017/q3/290
>
> ------------------------------------------
>
> [Has vendor confirmed or acknowledged the vulnerability?]
> true
Use CVE-2017-12941.
> [Suggested description]
> libunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ
> function.
>
> ------------------------------------------
>
> [Additional Information]
> Someone else might have requested CVEs.
>
> ------------------------------------------
>
> [Vulnerability Type]
> memory safety
>
> ------------------------------------------
>
> [Vendor of Product]
> unrar
>
> ------------------------------------------
>
> [Affected Product Code Base]
> unrar - 5.5.7
>
> ------------------------------------------
>
> [Reference]
> http://seclists.org/oss-sec/2017/q3/290
>
> ------------------------------------------
>
> [Has vendor confirmed or acknowledged the vulnerability?]
> true
Use CVE-2017-12942.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
