PT-2005-5157 · Rarlab+1 · Winrar

Agoanywhere · Publicado 2005-12-21 · Atualizado 2018-10-19 · CVE-2005-4474

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Média

Vetor base

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions WinRAR version 3.51

Description A buffer overflow issue exists in the "Add to archive" command, potentially allowing attackers to cause a denial of service (crash) and possibly execute arbitrary code. This can be achieved by tricking the user into adding a file with a filename containing non-default code page and non-ANSI characters. The issue may be related to buffer expansion when using the WideCharToMultiByte API.

Recommendations For WinRAR version 3.51, consider avoiding the use of filenames with non-default code page and non-ANSI characters in the "Add to archive" command until a fix is available. As a temporary workaround, restrict the use of the "Add to archive" command with files having special characters in their filenames to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2005-4474

Produtos afetados

Winrar

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2005-4474 · Nota de Segurança
• http://securityfocus.com/bid/15999 · Nota
• http://securityfocus.com/archive/1/archive/1/420006/100/0/threaded · Nota
• http://securityreason.com/securityalert/290 · Nota
• http://securityfocus.com/archive/1/420006/100/0/threaded · Nota