PT-2018-3778 · Rarlab · Unrar

Published 2018-08-12 · Updated 2021-07-07 · CVE-2018-25018

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions UnRAR versions 5.6.1.7 through 5.7.4 UnRAR version 6.0.3

Description The issue is related to an out-of-bounds write during a memcpy in QuickOpen::ReadRaw when called from QuickOpen::ReadNext. This can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For UnRAR versions 5.6.1.7 through 5.7.4, consider updating to a version that fixes the out-of-bounds write issue in QuickOpen::ReadRaw. For UnRAR version 6.0.3, consider updating to a version that fixes the out-of-bounds write issue in QuickOpen::ReadRaw. As a temporary workaround, consider disabling the QuickOpen::ReadRaw function until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2022-01765

CVE-2018-25018

Affected Products

Unrar

References · 15

• 🔥 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9845 · Exploit
• https://cve.org/CVERecord?id=CVE-2018-25018 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-25018 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-25018 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20231214SE16 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-25018 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-25018 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01765 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-25018 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-25018 · Vendor Advisory
• https://github.com/google/oss-fuzz-vulns/blob/main/vulns/unrar/OSV-2018-204.yaml · Note
• https://github.com/aawc/unrar/releases · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-25018 · Note
• https://t.me/cibsecurity/25848 · Telegram Post
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.6 · Note