7-Zip < 18.05 Memory Corruption Arbitrary Code Execution

high Nessus Plugin ID 109730

Language:

Synopsis

A compression utility installed on the remote Windows host is affected by arbitrary code execution.

Description

The version of 7-Zip installed on the remote Windows host contains a flaw in the NArchive::NRar::CHandler::Extract method in Archive/Rar/RarHandler.cpp. The issue is triggered as certain input is not properly validated when performing 'solid' decompression of a RAR archive. With a specially crafted file, a context-dependent attacker can corrupt memory to cause a denial of service or potentially execute arbitrary code.

Solution

Upgrade to 7-Zip version 18.05 or later.

Plugin Details

Severity: High

ID: 109730

File Name: 7zip_18_05.nasl

Version: 1.5

Type: local

Agent: windows

Family: Windows

Published: 5/11/2018

Updated: 9/19/2022

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2018-10115

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:7-zip:7-zip

Required KB Items: installed_sw/7-Zip

Exploit Ease: No known exploits are available

Patch Publication Date: 5/1/2018

Vulnerability Publication Date: 5/1/2018

Reference Information

CVE: CVE-2018-10115

BID: 104132

IAVA: 2018-A-0147-S

Detections

Analytics