Stack-based buffer overflow in RARLabs Unrar, as packaged in WinRAR and possibly other products, allows user-assisted remote attackers to execute arbitrary code via a crafted, password-protected archive.

This update fixes a stack-based buffer overflow in unrar that can be exploited with user-assistance by sending a password-protected archive. (CVE-2007-0855)

This update fixes a stack-absed buffer overflow in unrar that can be exploited with user-assistence by sending a password-protected archive. (CVE-2007-0855)

iDefense reports :

Remote exploitation of a stack based buffer overflow vulnerability in RARLabs Unrar may allow an attacker to execute arbitrary code with the privileges of the user opening the archive.

Unrar is prone to a stack based buffer overflow when processing specially crafted password protected archives.

If users are using the vulnerable command line based unrar, they still need to interact with the program in order to trigger the vulnerability. They must respond to the prompt asking for the password, after which the vulnerability will be triggered. They do not need to enter a correct password, but they must at least push the enter key.

The remote host is affected by the vulnerability described in GLSA-200702-04 (RAR, UnRAR: Buffer overflow)

    RAR and UnRAR contain a boundary error when processing     password-protected archives that could result in a stack-based buffer     overflow.
  Impact :

    A remote attacker could entice a user to process a specially crafted     password-protected archive and execute arbitrary code with the rights     of the user uncompressing the archive.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
41121	SuSE9 Security Update : unrar (YOU Patch Number 11465)	Nessus	SuSE Local Security Checks	medium
29593	SuSE 10 Security Update : unrar (ZYPP Patch Number 2997)	Nessus	SuSE Local Security Checks	medium
27473	openSUSE 10 Security Update : unrar (unrar-2996)	Nessus	SuSE Local Security Checks	medium
24366	FreeBSD : rar -- password prompt buffer overflow vulnerability (94234e00-be8a-11db-b2ec-000c6ec775d9)	Nessus	FreeBSD Local Security Checks	medium
24353	GLSA-200702-04 : RAR, UnRAR: Buffer overflow	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2007-0855

high

Tenable Plugins

medium

medium

medium

medium

medium