Vulnerabilities > CVE-2018-20253 - Out-of-bounds Write vulnerability in Rarlab Winrar

047910
CVSS 7.8 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
local
low complexity
rarlab
CWE-787
nessus
NVD
Published: 2019-02-13
Updated: 2024-11-21

Summary

In WinRAR versions prior to and including 5.60, There is an out-of-bounds write vulnerability during parsing of a crafted LHA / LZH archive formats. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Vulnerable Configurations

Part Description Count
Application
Rarlab
21

Common Weakness Enumeration (CWE)

Nessus

NASL familyWindows
NASL idWINRAR_5_70_BETA_1.NASL
descriptionThe version of RARLAB WinRAR installed on the remote Windows host is prior to 5.70 Beta 1. It is, therefore, affected by the following vulnerabilities : - An error exists in the file
last seen2020-06-01
modified2020-06-02
plugin id122448
published2019-02-27
reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/122448
titleRARLAB WinRAR < 5.70 Beta 1 Multiple Vulnerabilities
code
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(122448);
  script_version("1.6");
  script_cvs_date("Date: 2020/01/10");

  script_cve_id(
      "CVE-2018-20250",
      "CVE-2018-20251",
      "CVE-2018-20252",
      "CVE-2018-20253"
  );
  script_bugtraq_id(106948);
  script_xref(name:"IAVA", value:"2020-A-0007");

  script_name(english:"RARLAB WinRAR < 5.70 Beta 1 Multiple Vulnerabilities");
  script_summary(english:"Checks the version of WinRAR.");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Windows host is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of RARLAB WinRAR installed on the remote Windows host is
prior to 5.70 Beta 1. It is, therefore, affected by the following
vulnerabilities :

  - An error exists in the file 'unacev2.dll' related to
    the 'filename' field, that allows a specially crafted
    ACE archive to overwrite files outside the destination
    folder. Such files could be in the system startup
    locations, and thus, lead to arbitrary code execution on
    next boot. (CVE-2018-20250)

  - An input-validation error exists in the file
    'unacev2.dll' related to handling ACE archives and
    filenames that allows path traversal pattern checking
    to be bypassed. (CVE-2018-2051)

  - An out-of-bounds write error exists related to handling
    ACE and RAR file parsing that allows arbitrary code
    execution. (CVE-2018-20252)

  - An out-of-bounds write error exists related to handling
    LHA and LZH file parsing that allows arbitrary code
    execution. (CVE-2018-20253)");
  script_set_attribute(attribute:"see_also", value:"https://research.checkpoint.com/extracting-code-execution-from-winrar/");
  script_set_attribute(attribute:"see_also", value:"https://github.com/Ridter/acefile");
  script_set_attribute(attribute:"solution", value:
"Upgrade to WinRAR version 5.70 Beta 1 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-20250");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'RARLAB WinRAR ACE Format Input Validation Remote Code Execution');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/02/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/02/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2019/02/27");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:rarlab:winrar");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("winrar_win_installed.nbin");
  script_require_keys("installed_sw/RARLAB WinRAR", "SMB/Registry/Enumerated");
  exit(0);
}

include("vcf.inc");

get_kb_item_or_exit("SMB/Registry/Enumerated");

app_info = vcf::get_app_info(app:"RARLAB WinRAR", win_local:TRUE);

constraints = [
  { "fixed_version" : "5.70.beta1", fixed_display: "5.70 Beta 1" }
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);

References