PT-2004-2403 · Rarlab+1 · Winrar

Peter Winter-Smith · Publicado 2004-12-31 · Atualizado 2017-07-11 · CVE-2004-1495

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions WinRAR version 3.40

Description The issue is related to the Repair Archive command in WinRAR, which can be exploited by remote attackers to cause a denial of service, resulting in an application crash. This is achieved by using a corrupt ZIP archive. The problem is triggered when the Repair command is used on a corrupt ZIP archive, leading to a loss of availability for the service.

Recommendations For WinRAR version 3.40, as a temporary workaround, consider disabling the Repair Archive command until a patch is available. Restrict access to the Repair function to minimize the risk of exploitation. Avoid using the Repair command on untrusted or potentially corrupt ZIP archives until the issue is resolved.

Correção

Identificadores relacionados

CVE-2004-1495

Produtos afetados

Winrar

Referências · 8

• http://marc.theaimsgroup.com/?l=bugtraq&m=109941351432699&w=2 · Nota
• http://secunia.com/advisories/13070 · Correção
• http://rarlabs.com/rarnew.htm · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-1495 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17937 · Nota
• http://marc.info/?l=bugtraq&m=109941351432699&w=2 · Nota
• http://securityfocus.com/bid/11581 · Correção
• http://xforce.iss.net/xforce/xfdb/17937 · Nota