Vulnerability-Lookup

CNVD-2019-04913

Vulnerability from cnvd - Published: 2019-02-22

Title

WinRAR ACE/RAR任意代码执行漏洞

Description

WinRAR是一款压缩包管理器，作为档案工具RAR在 Windows环境下的图形界面，可用于备份数据、压缩文件、解压RAR/ZIP等格式的文件、创建 RAR/ZIP 等格式的压缩文件，得到了较为广泛的应用。 WinRAR ACE/RAR存在任意代码执行漏洞，攻击者可利用该漏洞执行任意代码。

Severity

高

Patch Name

WinRAR ACE/RAR任意代码执行漏洞的补丁

Patch Description

WinRAR是一款压缩包管理器，作为档案工具RAR在 Windows环境下的图形界面，可用于备份数据、压缩文件、解压RAR/ZIP等格式的文件、创建 RAR/ZIP 等格式的压缩文件，得到了较为广泛的应用。 WinRAR ACE/RAR存在任意代码执行漏洞，攻击者可利用该漏洞执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

WinRAR厂商已发布新版本修复此漏洞，建议立即升级至最新版本： https://www.win-rar.com/download.html

Impacted products

Name
WinRAR WinRAR <5.70 Beta 1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-20252"
    }
  },
  "description": "WinRAR\u662f\u4e00\u6b3e\u538b\u7f29\u5305\u7ba1\u7406\u5668\uff0c\u4f5c\u4e3a\u6863\u6848\u5de5\u5177RAR\u5728 Windows\u73af\u5883\u4e0b\u7684\u56fe\u5f62\u754c\u9762\uff0c\u53ef\u7528\u4e8e\u5907\u4efd\u6570\u636e\u3001\u538b\u7f29\u6587\u4ef6\u3001\u89e3\u538bRAR/ZIP\u7b49\u683c\u5f0f\u7684\u6587\u4ef6\u3001\u521b\u5efa RAR/ZIP \u7b49\u683c\u5f0f\u7684\u538b\u7f29\u6587\u4ef6\uff0c\u5f97\u5230\u4e86\u8f83\u4e3a\u5e7f\u6cdb\u7684\u5e94\u7528\u3002\n\nWinRAR ACE/RAR\u5b58\u5728\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "discovererName": "Check Point",
  "formalWay": "WinRAR\u5382\u5546\u5df2\u53d1\u5e03\u65b0\u7248\u672c\u4fee\u590d\u6b64\u6f0f\u6d1e\uff0c\u5efa\u8bae\u7acb\u5373\u5347\u7ea7\u81f3\u6700\u65b0\u7248\u672c\uff1a\r\nhttps://www.win-rar.com/download.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-04913",
  "openTime": "2019-02-22",
  "patchDescription": "WinRAR\u662f\u4e00\u6b3e\u538b\u7f29\u5305\u7ba1\u7406\u5668\uff0c\u4f5c\u4e3a\u6863\u6848\u5de5\u5177RAR\u5728 Windows\u73af\u5883\u4e0b\u7684\u56fe\u5f62\u754c\u9762\uff0c\u53ef\u7528\u4e8e\u5907\u4efd\u6570\u636e\u3001\u538b\u7f29\u6587\u4ef6\u3001\u89e3\u538bRAR/ZIP\u7b49\u683c\u5f0f\u7684\u6587\u4ef6\u3001\u521b\u5efa RAR/ZIP \u7b49\u683c\u5f0f\u7684\u538b\u7f29\u6587\u4ef6\uff0c\u5f97\u5230\u4e86\u8f83\u4e3a\u5e7f\u6cdb\u7684\u5e94\u7528\u3002\r\n\r\nWinRAR ACE/RAR\u5b58\u5728\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "WinRAR ACE/RAR\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "WinRAR WinRAR \u003c5.70 Beta 1"
  },
  "serverity": "\u9ad8",
  "submitTime": "2019-02-21",
  "title": "WinRAR ACE/RAR\u4efb\u610f\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

CVE-2018-20252 (GCVE-0-2018-20252)

Vulnerability from cvelistv5 – Published: 2019-02-05 20:00 – Updated: 2024-09-16 18:24

Summary

In WinRAR versions prior to and including 5.60, there is an out-of-bounds write vulnerability during parsing of crafted ACE and RAR archive formats. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Severity

No CVSS data available.

CWE

CWE-787 - Out-of-bounds Write

Assigner

checkpoint mitre root

References

3 references

URL	Tags
https://research.checkpoint.com/extracting-code-e…	x_refsource_MISC
http://www.securityfocus.com/bid/106948	vdb-entryx_refsource_BID
https://www.win-rar.com/whatsnew.html	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
Check Point Software Technologies Ltd.	WinRAR	Affected: All versions prior and including 5.60

Date Public

2019-02-05 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:58:19.176Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://research.checkpoint.com/extracting-code-execution-from-winrar/"
          },
          {
            "name": "106948",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106948"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.win-rar.com/whatsnew.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WinRAR",
          "vendor": "Check Point Software Technologies Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior and including 5.60"
            }
          ]
        }
      ],
      "datePublic": "2019-02-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In WinRAR versions prior to and including 5.60, there is an out-of-bounds write vulnerability during parsing of crafted ACE and RAR archive formats. Successful exploitation could lead to arbitrary code execution in the context of the current user."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787: Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-03-14T17:57:01.000Z",
        "orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
        "shortName": "checkpoint"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://research.checkpoint.com/extracting-code-execution-from-winrar/"
        },
        {
          "name": "106948",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106948"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.win-rar.com/whatsnew.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@checkpoint.com",
          "DATE_PUBLIC": "2019-02-05T00:00:00",
          "ID": "CVE-2018-20252",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "WinRAR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions prior and including 5.60"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Check Point Software Technologies Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In WinRAR versions prior to and including 5.60, there is an out-of-bounds write vulnerability during parsing of crafted ACE and RAR archive formats. Successful exploitation could lead to arbitrary code execution in the context of the current user."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-787: Out-of-bounds Write"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://research.checkpoint.com/extracting-code-execution-from-winrar/",
              "refsource": "MISC",
              "url": "https://research.checkpoint.com/extracting-code-execution-from-winrar/"
            },
            {
              "name": "106948",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106948"
            },
            {
              "name": "https://www.win-rar.com/whatsnew.html",
              "refsource": "MISC",
              "url": "https://www.win-rar.com/whatsnew.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
    "assignerShortName": "checkpoint",
    "cveId": "CVE-2018-20252",
    "datePublished": "2019-02-05T20:00:00.000Z",
    "dateReserved": "2018-12-19T00:00:00.000Z",
    "dateUpdated": "2024-09-16T18:24:07.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.