PT-2017-6416 · Winrar · Rar

Jakub Wilk · Publicado 2017-06-04 · Atualizado 2017-06-12 · CVE-2014-9983

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions RAR versions 4.x through 5.x

Description The issue allows remote attackers to write to arbitrary files by creating a crafted archive that includes symlinks. When an unpack operation is performed, it follows any symlinks contained in the archive, enabling the attack.

Recommendations For RAR versions 4.x through 5.x, consider avoiding the use of symlinks in archives until a patch is available. As a temporary workaround, restrict the unpack operation to prevent it from following symlinks.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-9983

Produtos afetados

Rar

Referências · 8

• 🔥 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774172 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9983 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-9983 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-9983 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9983 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-9983 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-9983 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-9983 · Nota de Segurança