PT-2009-2613 · Rarlab · Winrar

Published 2009-09-01 · Updated 2017-08-17 · CVE-2008-7144

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WinRAR versions prior to 3.71

Description The issue is related to multiple unspecified vulnerabilities in WinRAR, which can be triggered by crafted archive files, including ACE, ARJ, BZ2, CAB, GZ, LHA, RAR, TAR, or ZIP files. The OUSPG PROTOS GENOME test suite for Archive Formats has demonstrated the potential impact of these vulnerabilities.

Recommendations For versions prior to 3.71, update to version 3.71 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted archive files until the update is applied. Restrict access to the archive handling functionality to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2008-7144

Affected Products

Winrar

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2008-7144 · Security Note
• http://secunia.com/advisories/29407 · Vendor Advisory
• http://vupen.com/english/advisories/2008/0916/references · Vendor Advisory
• http://cert.fi/haavoittuvuudet/joint-advisory-archive-formats.html · Note
• http://ee.oulu.fi/research/ouspg/protos/testing/c10/archive · Note
• http://osvdb.org/43439 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41251 · Note