PT-2004-2403 · Rarlab+1 · Winrar

Peter Winter-Smith · Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-1495

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions WinRAR version 3.40

Description The issue is related to the Repair Archive command in WinRAR, which can be exploited by remote attackers to cause a denial of service, resulting in an application crash. This is achieved by using a corrupt ZIP archive. The problem is triggered when the Repair command is used on a corrupt ZIP archive, leading to a loss of availability for the service.

Recommendations For WinRAR version 3.40, as a temporary workaround, consider disabling the Repair Archive command until a patch is available. Restrict access to the Repair function to minimize the risk of exploitation. Avoid using the Repair command on untrusted or potentially corrupt ZIP archives until the issue is resolved.

Fix

Related Identifiers

CVE-2004-1495

Affected Products

Winrar

References · 8

• http://secunia.com/advisories/13070 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2004-1495 · Security Note
• http://securityfocus.com/bid/11581 · Patch
• http://marc.theaimsgroup.com/?l=bugtraq&m=109941351432699&w=2 · Note
• http://rarlabs.com/rarnew.htm · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17937 · Note
• http://marc.info/?l=bugtraq&m=109941351432699&w=2 · Note
• http://xforce.iss.net/xforce/xfdb/17937 · Note