CVE-2023-40477

03.05.2024, 03:15

RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-21233.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.8 HIGH	LOCAL	LOW	NONE	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
zdi	CNA	7.8 HIGH				CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA-ADP	ADP	---				---
CVE	ADP	---				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 99%

Debian Releases

Debian Product

Codename

libclamunrar

bullseye/non-free	0.103.10-1~deb11u1 fixed
bullseye/non-free (security)	1.0.3-1~deb11u1 fixed
bookworm/non-free	1.0.3-1~deb12u1 fixed
trixie/non-free	1.3.1-1 fixed
sid/non-free	1.3.1-1 fixed

rar

bullseye/non-free	2:6.23-1~deb11u1 fixed
bookworm/non-free	2:6.23-1~deb12u1 fixed
trixie/non-free	2:7.10~b1-2 fixed
sid/non-free	2:7.10~b1-2 fixed

unrar-nonfree

bullseye/non-free	1:6.0.3-1+deb11u3 fixed
bookworm/non-free	1:6.2.6-1+deb12u1 fixed
trixie/non-free	1:7.1.2-3 fixed
sid/non-free	1:7.1.2-3 fixed

Ubuntu Releases

Ubuntu Product

Codename

libclamunrar

oracular	not-affected
noble	not-affected
mantic	Fixed 1.0.4-0ubuntu0.23.10.1 released
lunar	Fixed 0.103.11-0ubuntu0.23.04.1 released
jammy	Fixed 0.103.11-0ubuntu0.22.04.1 released
focal	Fixed 0.103.11-0ubuntu0.20.04.1 released
bionic	needed
xenial	needed
trusty	ignored

rar

oracular	Fixed 2:6.23-1 released
noble	Fixed 2:6.23-1 released
mantic	Fixed 2:6.23-1 released
lunar	ignored
jammy	needed
focal	needed
bionic	needed
xenial	needed
trusty	ignored

unrar-nonfree

oracular	not-affected
noble	not-affected
mantic	not-affected
lunar	ignored
jammy	needed
focal	needed
bionic	needed
xenial	needed
trusty	ignored

Common Weakness Enumeration

CWE-129 - Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

References

https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa

https://www.zerodayinitiative.com/advisories/ZDI-23-1152/

https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa

https://www.zerodayinitiative.com/advisories/ZDI-23-1152/