SB2024040145 - Multiple vulnerabilities in WinRAR

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Security features bypass (CVE-ID: CVE-2024-30370)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error within the archive extraction functionality. A remote attacker can use a specially crafted archive to bypass the Mark-Of-The-Web protection mechanism and potentially compromise the affected system.

2) Input validation error (CVE-ID: CVE-2024–36052)

The vulnerability allows a remote attacker to perform a denial of service or spoofing attack.

The vulnerability exists due to insufficient validation of ANSI escape sequences within the CLI interface. A remote attacker can pass specially crafted input via CLI and spoof the archive output or perform a denial of service (DoS) attack.

Note, the vulnerability affects Windows installations only.

Remediation

Install update from vendor's website.

References

• https://www.zerodayinitiative.com/advisories/ZDI-24-357/
• https://www.rarlab.com/rarnew.htm#27.%20Busgs%20fixed
• https://www.rarlab.com/rarnew.htm
• https://sdushantha.medium.com/ansi-escape-injection-vulnerability-in-winrar-a2cbfac4b983