Re: Re: ***UNCHECKED*** [oss-security] UnRAR: directory traversal + memory safety bugs

[Marcus Meissner <meissner () suse de>]

Quoting from MITRE:

> > There is also a memory overread / corruption issues, are you going to assign
> > more CVEs?

Yes, we looked further and it appears that all of the other issues can
have CVEs.

Specifically, the UnRAR license says "UnRAR source code may be used in
any software to handle RAR archives without limitations free of
charge, but cannot be used to develop RAR (WinRAR) compatible archiver
and to re-create RAR compression algorithm, which is proprietary."
Also, the makefile can be used to build libraries from the code
(libunrar.a, etc.). Therefore, someone might have a long-running
process executing the UnRAR code, and any arbitrary crash
(out-of-bounds read, etc.) could be a denial of service.

Although this scenario may be unlikely, here are the three CVE IDs
anyway.


> [Suggested description]
> libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode
> call within the Archive::ReadHeader15 function.
>
> ------------------------------------------
>
> [Additional Information]
> Someone else might have requested CVEs.
>
> ------------------------------------------
>
> [Vulnerability Type]
> memory safety
>
> ------------------------------------------
>
> [Vendor of Product]
> unrar
>
> ------------------------------------------
>
> [Affected Product Code Base]
> unrar - 5.5.7
>
> ------------------------------------------
>
> [Reference]
> http://seclists.org/oss-sec/2017/q3/290
>
> ------------------------------------------
>
> [Has vendor confirmed or acknowledged the vulnerability?]
> true

Use CVE-2017-12940.


> [Suggested description]
> libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20
> function.
>
> ------------------------------------------
>
> [Additional Information]
> Someone else might have requested CVEs.
>
> ------------------------------------------
>
> [Vulnerability Type]
> memory safety
>
> ------------------------------------------
>
> [Vendor of Product]
> unrar
>
> ------------------------------------------
>
> [Affected Product Code Base]
> unrar - 5.5.7
>
> ------------------------------------------
>
> [Reference]
> http://seclists.org/oss-sec/2017/q3/290
>
> ------------------------------------------
>
> [Has vendor confirmed or acknowledged the vulnerability?]
> true

Use CVE-2017-12941.


> [Suggested description]
> libunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ
> function.
>
> ------------------------------------------
>
> [Additional Information]
> Someone else might have requested CVEs.
>
> ------------------------------------------
>
> [Vulnerability Type]
> memory safety
>
> ------------------------------------------
>
> [Vendor of Product]
> unrar
>
> ------------------------------------------
>
> [Affected Product Code Base]
> unrar - 5.5.7
>
> ------------------------------------------
>
> [Reference]
> http://seclists.org/oss-sec/2017/q3/290
>
> ------------------------------------------
>
> [Has vendor confirmed or acknowledged the vulnerability?]
> true

Use CVE-2017-12942.