Vulnerability-Lookup

CNVD-2019-04912

Vulnerability from cnvd - Published: 2019-02-22

Title

WinRAR ACE文件名逻辑验证绕过漏洞

Description

WinRAR是一款压缩包管理器，作为档案工具RAR在 Windows环境下的图形界面，可用于备份数据、压缩文件、解压RAR/ZIP等格式的文件、创建 RAR/ZIP 等格式的压缩文件，得到了较为广泛的应用。 WinRAR ACE文件名存在逻辑验证绕过漏洞。攻击者可在未授权的情况下实现任意代码执行。

Severity

高

Patch Name

WinRAR ACE文件名逻辑验证绕过漏洞的补丁

Patch Description

WinRAR是一款压缩包管理器，作为档案工具RAR在 Windows环境下的图形界面，可用于备份数据、压缩文件、解压RAR/ZIP等格式的文件、创建 RAR/ZIP 等格式的压缩文件，得到了较为广泛的应用。 WinRAR ACE文件名存在逻辑验证绕过漏洞。攻击者可在未授权的情况下实现任意代码执行。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

WinRAR厂商已发布新版本修复此漏洞，建议立即升级至最新版本： https://www.win-rar.com/download.html

Reference

https://research.checkpoint.com/extracting-code-execution-from-winrar/

Impacted products

Name
WinRAR WinRAR <70 Beta 1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-20251"
    }
  },
  "description": "WinRAR\u662f\u4e00\u6b3e\u538b\u7f29\u5305\u7ba1\u7406\u5668\uff0c\u4f5c\u4e3a\u6863\u6848\u5de5\u5177RAR\u5728 Windows\u73af\u5883\u4e0b\u7684\u56fe\u5f62\u754c\u9762\uff0c\u53ef\u7528\u4e8e\u5907\u4efd\u6570\u636e\u3001\u538b\u7f29\u6587\u4ef6\u3001\u89e3\u538bRAR/ZIP\u7b49\u683c\u5f0f\u7684\u6587\u4ef6\u3001\u521b\u5efa RAR/ZIP \u7b49\u683c\u5f0f\u7684\u538b\u7f29\u6587\u4ef6\uff0c\u5f97\u5230\u4e86\u8f83\u4e3a\u5e7f\u6cdb\u7684\u5e94\u7528\u3002\n\nWinRAR ACE\u6587\u4ef6\u540d\u5b58\u5728\u903b\u8f91\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5728\u672a\u6388\u6743\u7684\u60c5\u51b5\u4e0b\u5b9e\u73b0\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002",
  "discovererName": "WinRAR",
  "formalWay": "WinRAR\u5382\u5546\u5df2\u53d1\u5e03\u65b0\u7248\u672c\u4fee\u590d\u6b64\u6f0f\u6d1e\uff0c\u5efa\u8bae\u7acb\u5373\u5347\u7ea7\u81f3\u6700\u65b0\u7248\u672c\uff1a\r\nhttps://www.win-rar.com/download.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-04912",
  "openTime": "2019-02-22",
  "patchDescription": "WinRAR\u662f\u4e00\u6b3e\u538b\u7f29\u5305\u7ba1\u7406\u5668\uff0c\u4f5c\u4e3a\u6863\u6848\u5de5\u5177RAR\u5728 Windows\u73af\u5883\u4e0b\u7684\u56fe\u5f62\u754c\u9762\uff0c\u53ef\u7528\u4e8e\u5907\u4efd\u6570\u636e\u3001\u538b\u7f29\u6587\u4ef6\u3001\u89e3\u538bRAR/ZIP\u7b49\u683c\u5f0f\u7684\u6587\u4ef6\u3001\u521b\u5efa RAR/ZIP \u7b49\u683c\u5f0f\u7684\u538b\u7f29\u6587\u4ef6\uff0c\u5f97\u5230\u4e86\u8f83\u4e3a\u5e7f\u6cdb\u7684\u5e94\u7528\u3002\r\n\r\nWinRAR ACE\u6587\u4ef6\u540d\u5b58\u5728\u903b\u8f91\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5728\u672a\u6388\u6743\u7684\u60c5\u51b5\u4e0b\u5b9e\u73b0\u4efb\u610f\u4ee3\u7801\u6267\u884c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "WinRAR ACE\u6587\u4ef6\u540d\u903b\u8f91\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "WinRAR WinRAR \u003c70 Beta 1"
  },
  "referenceLink": "https://research.checkpoint.com/extracting-code-execution-from-winrar/",
  "serverity": "\u9ad8",
  "submitTime": "2019-02-21",
  "title": "WinRAR ACE\u6587\u4ef6\u540d\u903b\u8f91\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2018-20251 (GCVE-0-2018-20251)

Vulnerability from cvelistv5 – Published: 2019-02-05 20:00 – Updated: 2024-09-16 21:04

Summary

In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNACEV2.dll) creates files and folders as written in the filename field even when WinRAR validator noticed the traversal attempt and requestd to abort the extraction process. the operation is cancelled only after the folders and files were created but prior to them being written, therefore allowing the attacker to create empty files and folders everywhere in the file system.

Severity

No CVSS data available.

CWE

CWE-693 - Protection Mechanism Failure

Assigner

checkpoint mitre root

References

3 references

URL	Tags
https://research.checkpoint.com/extracting-code-e…	x_refsource_MISC
http://www.securityfocus.com/bid/106948	vdb-entryx_refsource_BID
https://www.win-rar.com/whatsnew.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Check Point Software Technologies Ltd.	WinRAR	Affected: All versions prior and including 5.61

Date Public

2019-02-05 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:58:19.020Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://research.checkpoint.com/extracting-code-execution-from-winrar/"
          },
          {
            "name": "106948",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106948"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.win-rar.com/whatsnew.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WinRAR",
          "vendor": "Check Point Software Technologies Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior and including 5.61"
            }
          ]
        }
      ],
      "datePublic": "2019-02-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNACEV2.dll) creates files and folders as written in the filename field even when WinRAR validator noticed the traversal attempt and requestd to abort the extraction process. the operation is cancelled only after the folders and files were created but prior to them being written, therefore allowing the attacker to create empty files and folders everywhere in the file system."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-03-14T17:57:01.000Z",
        "orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
        "shortName": "checkpoint"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://research.checkpoint.com/extracting-code-execution-from-winrar/"
        },
        {
          "name": "106948",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106948"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.win-rar.com/whatsnew.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@checkpoint.com",
          "DATE_PUBLIC": "2019-02-05T00:00:00",
          "ID": "CVE-2018-20251",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "WinRAR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions prior and including 5.61"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Check Point Software Technologies Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNACEV2.dll) creates files and folders as written in the filename field even when WinRAR validator noticed the traversal attempt and requestd to abort the extraction process. the operation is cancelled only after the folders and files were created but prior to them being written, therefore allowing the attacker to create empty files and folders everywhere in the file system."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-693: Protection Mechanism Failure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://research.checkpoint.com/extracting-code-execution-from-winrar/",
              "refsource": "MISC",
              "url": "https://research.checkpoint.com/extracting-code-execution-from-winrar/"
            },
            {
              "name": "106948",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106948"
            },
            {
              "name": "https://www.win-rar.com/whatsnew.html",
              "refsource": "MISC",
              "url": "https://www.win-rar.com/whatsnew.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
    "assignerShortName": "checkpoint",
    "cveId": "CVE-2018-20251",
    "datePublished": "2019-02-05T20:00:00.000Z",
    "dateReserved": "2018-12-19T00:00:00.000Z",
    "dateUpdated": "2024-09-16T21:04:19.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.