CVE-2023-40477

EUVD-2023-45048

03.05.2024, 03:15

RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21233.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	NONE	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 99%

Affected Products (NVD)

Vendor	Product	Version
rarlab	winrar	𝑥 < 6.23

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

libclamunrar

bookworm/non-free	1.0.3-1~deb12u1 fixed
bullseye/non-free	0.103.10-1~deb11u1 fixed
bullseye/non-free (security)	1.0.3-1~deb11u1 fixed
sid/non-free	1.3.1-1 fixed
trixie/non-free	1.3.1-1 fixed

rar

bookworm/non-free	2:6.23-1~deb12u1 fixed
bullseye/non-free	2:6.23-1~deb11u1 fixed
sid/non-free	2:7.10~b1-2 fixed
trixie/non-free	2:7.10~b1-2 fixed

unrar-nonfree

bookworm/non-free	1:6.2.6-1+deb12u1 fixed
bullseye/non-free	1:6.0.3-1+deb11u3 fixed
sid/non-free	1:7.1.2-3 fixed
trixie/non-free	1:7.1.2-3 fixed

Ubuntu Releases

Ubuntu Product

Codename

libclamunrar

bionic	needed
focal	Fixed 0.103.11-0ubuntu0.20.04.1 released
jammy	Fixed 0.103.11-0ubuntu0.22.04.1 released
lunar	Fixed 0.103.11-0ubuntu0.23.04.1 released
mantic	Fixed 1.0.4-0ubuntu0.23.10.1 released
noble	not-affected
oracular	not-affected
trusty	ignored
xenial	needed

rar

bionic	needed
focal	needed
jammy	needed
lunar	ignored
mantic	Fixed 2:6.23-1 released
noble	Fixed 2:6.23-1 released
oracular	Fixed 2:6.23-1 released
trusty	ignored
xenial	needed

unrar-nonfree

bionic	needed
focal	needed
jammy	needed
lunar	ignored
mantic	not-affected
noble	not-affected
oracular	not-affected
trusty	ignored
xenial	needed

openSUSE / SLES Releases

openSUSE Product

Release

clamav

suse enterprise desktop 15 SP4	0.103.11-150000.3.50.1 fixed
suse enterprise desktop 15 SP5	0.103.11-150000.3.50.1 fixed
suse enterprise desktop 15 SP6	0.103.11-150600.16.7 fixed
suse enterprise desktop 15 SP7	1.4.2-150600.18.9.3 fixed
suse enterprise sap 15 SP1	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP2	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP3	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP4	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP5	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP6	0.103.11-150600.16.7 fixed
suse enterprise sap 15 SP7	1.4.2-150600.18.9.3 fixed
suse enterprise server 15 SP1	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP2	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP3	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP4	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP5	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP6	0.103.11-150600.16.7 fixed
suse enterprise server 15 SP7	1.4.2-150600.18.9.3 fixed

clamav-devel

suse enterprise desktop 15 SP4	0.103.11-150000.3.50.1 fixed
suse enterprise desktop 15 SP5	0.103.11-150000.3.50.1 fixed
suse enterprise desktop 15 SP6	0.103.11-150600.16.7 fixed
suse enterprise desktop 15 SP7	1.4.2-150600.18.9.3 fixed
suse enterprise sap 15 SP1	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP2	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP3	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP4	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP5	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP6	0.103.11-150600.16.7 fixed
suse enterprise sap 15 SP7	1.4.2-150600.18.9.3 fixed
suse enterprise server 15 SP1	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP2	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP3	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP4	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP5	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP6	0.103.11-150600.16.7 fixed
suse enterprise server 15 SP7	1.4.2-150600.18.9.3 fixed

clamav-docs-html

suse enterprise desktop 15 SP7	1.4.2-150600.18.9.3 fixed
suse enterprise sap 15 SP7	1.4.2-150600.18.9.3 fixed
suse enterprise server 15 SP7	1.4.2-150600.18.9.3 fixed

clamav-milter

suse enterprise desktop 15 SP7	1.4.2-150600.18.9.3 fixed
suse enterprise sap 15 SP7	1.4.2-150600.18.9.3 fixed
suse enterprise server 15 SP7	1.4.2-150600.18.9.3 fixed

libclamav12

suse enterprise desktop 15 SP7	1.4.2-150600.18.9.3 fixed
suse enterprise sap 15 SP7	1.4.2-150600.18.9.3 fixed
suse enterprise server 15 SP7	1.4.2-150600.18.9.3 fixed

libclamav9

suse enterprise desktop 15 SP4	0.103.11-150000.3.50.1 fixed
suse enterprise desktop 15 SP5	0.103.11-150000.3.50.1 fixed
suse enterprise desktop 15 SP6	0.103.11-150600.16.7 fixed
suse enterprise sap 15 SP1	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP2	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP3	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP4	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP5	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP6	0.103.11-150600.16.7 fixed
suse enterprise server 15 SP1	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP2	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP3	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP4	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP5	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP6	0.103.11-150600.16.7 fixed

libclammspack0

suse enterprise desktop 15 SP7	1.4.2-150600.18.9.3 fixed
suse enterprise sap 15 SP7	1.4.2-150600.18.9.3 fixed
suse enterprise server 15 SP7	1.4.2-150600.18.9.3 fixed

libfreshclam2

suse enterprise desktop 15 SP4	0.103.11-150000.3.50.1 fixed
suse enterprise desktop 15 SP5	0.103.11-150000.3.50.1 fixed
suse enterprise desktop 15 SP6	0.103.11-150600.16.7 fixed
suse enterprise sap 15 SP1	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP2	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP3	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP4	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP5	0.103.11-150000.3.50.1 fixed
suse enterprise sap 15 SP6	0.103.11-150600.16.7 fixed
suse enterprise server 15 SP1	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP2	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP3	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP4	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP5	0.103.11-150000.3.50.1 fixed
suse enterprise server 15 SP6	0.103.11-150600.16.7 fixed

libfreshclam3

suse enterprise desktop 15 SP7	1.4.2-150600.18.9.3 fixed
suse enterprise sap 15 SP7	1.4.2-150600.18.9.3 fixed
suse enterprise server 15 SP7	1.4.2-150600.18.9.3 fixed

Common Weakness Enumeration

CWE-129 - Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

References

https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa

https://www.zerodayinitiative.com/advisories/ZDI-23-1152/

https://lists.debian.org/debian-lts-announce/2023/11/msg00009.html

https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa

https://www.zerodayinitiative.com/advisories/ZDI-23-1152/