WinRAR Multiple Unspecified Vulnerabilities

SA29407

CVE-2008-7144

19 Mar 2008

03 Sep 2009

Highly Critical

Vendor Patch

WinRAR 3.x

From remote

DoS (Denial of Service)

This includes vulnerabilities ranging from excessive resource consumption (e.g. causing a system to use a lot of memory) to crashing an application or an entire system.

System access

This covers vulnerabilities where malicious people are able to gain system access and execute arbitrary code with the privileges of a local user.

Some vulnerabilities have been reported in WinRAR, which can potentially be exploited by malicious people to compromise a vulnerable system.

The vulnerabilities are caused due to unspecified errors in the processing of archives and can be exploited to cause heap corruptions and stack-based buffer overflows via specially crafted archives.

Successful exploitation may allow execution of arbitrary code.

The vulnerabilities are reported in versions prior to 3.71.

Update to version 3.71.

Oulu University Secure Programming Group

http://www.ee.oulu.fi/research/ouspg/protos/testing/c10/archive/