libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function.

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2834-1 advisory.

  - A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat     Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer     overflow can be caused in DataSize+CurChannel. The result is a negative value of the DestPos variable,     which allows the attacker to write out of bounds when setting Mem[DestPos]. (CVE-2012-6706)

  - UnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via     vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file.
    (CVE-2017-12938)

  - libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the     Archive::ReadHeader15 function. (CVE-2017-12940)

  - libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function.
    (CVE-2017-12941)

  - libunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ function. (CVE-2017-12942)

  - UnRAR 5.6.1.2 and 5.6.1.3 has a heap-based buffer overflow in Unpack::CopyString (called from     Unpack::Unpack5 and CmdExtract::ExtractCurrentFile). (CVE-2017-20006)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for unrar to version 5.6.1 fixes several issues. These security issues were fixed :

  - CVE-2017-12938: Prevent remote attackers to bypass a     directory-traversal protection mechanism via vectors     involving a symlink to the . directory, a symlink to the     .. directory, and a regular file (bsc#1054038).

  - CVE-2017-12940: Prevent out-of-bounds read in the     EncodeFileName::Decode call within the     Archive::ReadHeader15 function (bsc#1054038).

  - CVE-2017-12941: Prevent an out-of-bounds read in the     Unpack::Unpack20 function (bsc#1054038).

  - CVE-2017-12942: Prevent a buffer overflow in the     Unpack::LongLZ function (bsc#1054038).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201709-24 (RAR, UnRAR: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in RAR and UnRAR. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker, by enticing a user to open a specially crafted RAR,       could possibly execute arbitrary code with the privileges of the process       or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
152833	SUSE SLED12 / SLES12 Security Update : unrar (SUSE-SU-2021:2834-1)	Nessus	SuSE Local Security Checks	critical
108828	SUSE SLES11 Security Update : unrar (SUSE-SU-2018:0862-1)	Nessus	SuSE Local Security Checks	critical
103463	GLSA-201709-24 : RAR, UnRAR: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2017-12941

critical

Tenable Plugins

critical

critical

critical