US warns of actively attacked vulnerability in UnRAR

nicolaasjan · Aug 10, 2022

From Dutch article:
https://www.security.nl/posting/764219/VS waarschuwt voor actief aangevallen kwetsbaarheid in UnRAR

Translated:

The U.S. government is warning federal government agencies in the country about an actively attacked security vulnerability in archiving software UnRAR. A path traversal vulnerability in UnRar allows an attacker to use a rogue RAR file to write files to locations where they are not intended.

In June, researchers demonstrated how the security vulnerability can be used to take over Zimbra mail servers. At the time, the vulnerability was not being exploited. That is now the case, the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) warns.

Details of the attacks were not given. However, an exploit to exploit the security hole has been added to Metasploit, an open source framework for testing the security of systems and networks and is very popular with penetration testers and security professionals. Federal government agencies using UnRAR have been ordered to patch the vulnerability by August 30. The problem has been fixed in UnRAR 6.12 (open source version 6.1.7) and newer.
Click to expand...

This is a vulnerability in UnRar for Linux/UNIX.
WinRAR and Android RAR are unaffected.

CVE-2022-30333.
https://nvd.nist.gov/vuln/detail/CVE-2022-30333

Patch:
Code:
https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz

reasonablePrivacy · Aug 11, 2022

Good to know. It isn't compliant with FOSS definition used by Debian thus only part of opt-in non-free part of repository.

nicolaasjan · Aug 11, 2022

reasonablePrivacy said: ↑

Good to know. It isn't compliant with FOSS definition used by Debian thus only part of opt-in non-free part of repository.
Click to expand...

I installed that patch by running 'make' and as a bonus I now also have the 'rar' executable.
From now on I can create rar archives from within my archive manager (Engrampa).

Until Linux Mint releases an update, I made a symlink 'unrar-nonfree' to point to the patched 'unrar' (in '/usr/local/bin').

Log in or Sign up

US warns of actively attacked vulnerability in UnRAR

nicolaasjan Registered Member

reasonablePrivacy Registered Member

nicolaasjan Registered Member

Log in or Sign up

US warns of actively attacked vulnerability in UnRAR

nicolaasjan Registered Member

reasonablePrivacy Registered Member

nicolaasjan Registered Member

Useful Searches