Home > Exploits > Software/Hardware > WinRAR Format String and Buffer Overflow Vulnerability

Vulnerability: WinRAR Format String and Buffer Overflow Vulnerability

Secunia Advisories: SA16973 and SA14359

CVE's: CVE-2005-0160 and CVE-2005-0161

US-CERT: 215006

Credit: Tan Chew Keong

Vulnerable: WinRAR v. 3.50 and earlier

Patch: Update to WinRAR v. 3.51

A format string error exists when displaying an invalid file name in a UUE/XXE encoded file error message.  An attacker when decoding a maliciously malformed UUE/XXE file can execute random code.

A remote attacker can also exploit a boundary error in UNACEV2.DLL when extracting a file with an overly long name from an ACE archive.  This exploit allows the non-authenticated user to execute arbitrary code on the system because of a stack-based buffer overflow.

Copyright (c) 2007, 2008  A. Ryan Robbins.  All Rights Reserved.