In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNACEV2.dll) creates files and folders as written in the filename field even when WinRAR validator noticed the traversal attempt and requestd to abort the extraction process. the operation is cancelled only after the folders and files were created but prior to them being written, therefore allowing the attacker to create empty files and folders everywhere in the file system.
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
| Link | Tags |
|---|---|
| https://research.checkpoint.com/extracting-code-execution-from-winrar/ | third party advisory exploit |
| http://www.securityfocus.com/bid/106948 | vdb entry third party advisory |
| https://www.win-rar.com/whatsnew.html | release notes vendor advisory |