A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the "DestPos" variable, which allows the attacker to write out of bounds when setting Mem[DestPos].

The remote SUSE Linux SLED12 / SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:2834-1 advisory.

  - A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat     Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer     overflow can be caused in DataSize+CurChannel. The result is a negative value of the DestPos variable,     which allows the attacker to write out of bounds when setting Mem[DestPos]. (CVE-2012-6706)

  - UnRAR before 5.5.7 allows remote attackers to bypass a directory-traversal protection mechanism via     vectors involving a symlink to the . directory, a symlink to the .. directory, and a regular file.
    (CVE-2017-12938)

  - libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the EncodeFileName::Decode call within the     Archive::ReadHeader15 function. (CVE-2017-12940)

  - libunrar.a in UnRAR before 5.5.7 has an out-of-bounds read in the Unpack::Unpack20 function.
    (CVE-2017-12941)

  - libunrar.a in UnRAR before 5.5.7 has a buffer overflow in the Unpack::LongLZ function. (CVE-2017-12942)

  - UnRAR 5.6.1.2 and 5.6.1.3 has a heap-based buffer overflow in Unpack::CopyString (called from     Unpack::Unpack5 and CmdExtract::ExtractCurrentFile). (CVE-2017-20006)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201804-16 (ClamAV: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in ClamAV. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, through multiple vectors, could execute arbitrary       code, cause a Denial of Service condition, or have other unspecified       impacts.
  Workaround :

    There is no known workaround at this time.

This update for clamav fixes the following issues: Security issues fixed :

  - CVE-2012-6706: VMSF_DELTA filter inside the unrar     implementation allows an arbitrary memory write     (bsc#1045315).

  - CVE-2017-6419: A heap-based buffer overflow that can     lead to a denial of service in libmspack via a crafted     CHM file (bsc#1052449).

  - CVE-2017-11423: A stack-based buffer over-read that can     lead to a denial of service in mspack via a crafted CAB     file (bsc#1049423).

  - CVE-2018-1000085: An out-of-bounds heap read     vulnerability was found in XAR parser that can lead to a     denial of service (bsc#1082858).

  - CVE-2018-0202: Fixed two vulnerabilities in the PDF     parsing code (bsc#1083915).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for unrar to version 5.6.1 fixes several issues. These security issues were fixed :

  - CVE-2017-12938: Prevent remote attackers to bypass a     directory-traversal protection mechanism via vectors     involving a symlink to the . directory, a symlink to the     .. directory, and a regular file (bsc#1054038).

  - CVE-2017-12940: Prevent out-of-bounds read in the     EncodeFileName::Decode call within the     Archive::ReadHeader15 function (bsc#1054038).

  - CVE-2017-12941: Prevent an out-of-bounds read in the     Unpack::Unpack20 function (bsc#1054038).

  - CVE-2017-12942: Prevent a buffer overflow in the     Unpack::LongLZ function (bsc#1054038).

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for clamav fixes the following issues :

Security issues fixed :

  - CVE-2012-6706: VMSF_DELTA filter inside the unrar     implementation allows an arbitrary memory write     (bsc#1045315).

  - CVE-2017-6419: A heap-based buffer overflow that can     lead to a denial of service in libmspack via a crafted     CHM file (bsc#1052449).

  - CVE-2017-11423: A stack-based buffer over-read that can     lead to a denial of service in mspack via a crafted CAB     file (bsc#1049423).

  - CVE-2018-1000085: An out-of-bounds heap read     vulnerability was found in XAR parser that can lead to a     denial of service (bsc#1082858).

  - CVE-2018-0202: Fixed two vulnerabilities in the PDF     parsing code (bsc#1083915).

This update was imported from the SUSE:SLE-12:Update update project.

Heap-based buffer overflow in mspack/lzxd.c

mspack/lzxd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2, allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted CHM file. (CVE-2017-6419)

Out-of-bounds access in the PDF parser (CVE-2018-0202)

A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the 'DestPos' variable, which allows the attacker to write out of bounds when setting Mem[DestPos]. (CVE-2012-6706)

ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains..
This attack appear to be exploitable via The victim must scan a crafted XAR file. (CVE-2018-1000085)

Stack-based buffer over-read in cabd_read_string function

The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as used in ClamAV 0.99.2 and other products, allows remote attackers to cause a denial of service (stack-based buffer over-read and application crash) via a crafted CAB file. (CVE-2017-11423)

Update to 0.99.4

0.99.4 addresses a few outstanding vulnerability bugs. It includes fixes for :

  - CVE-2012-6706

  - CVE-2017-6419

  - CVE-2017-11423 

  - CVE-2018-1000085 

There are also a few bug fixes that were not assigned CVE&rsquo;s, but were important enough to address while we had the chance. One of these was the notorious file descriptor exhaustion bug that caused outages late last January.

In addition to the above, 0.99.4 fixes :

  - CVE-2018-0202: Two newly reported vulnerabilities in the     PDF parsing code.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201710-21 (Kodi: Arbitrary code execution)

    Kodi is vulnerable due to shipping with an embedded version of UnRAR.
      Please review the referenced CVE identifier for details.
  Impact :

    A remote attacker, by enticing a user to process a specifically crafted       RAR file, could execute arbitrary code.
  Workaround :

    There is no known workaround at this time.

The remote host is affected by the vulnerability described in GLSA-201709-24 (RAR, UnRAR: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in RAR and UnRAR. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker, by enticing a user to open a specially crafted RAR,       could possibly execute arbitrary code with the privileges of the process       or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update for unrar to version 5.5 fixes the following issues :

Version 5.5.5

  - CVE-2012-6706: fixes VMSF_DELTA memory corruption     (boo#1045315) see     https://bugs.chromium.org/p/project-zero/issues/detail?i     d=1286&can=1&q=unrar&desc=2

Version 5.5.1

  - Based on RAR 5.50 beta1

  - Added extraction support for .LZ archives created by     Lzip compressor.

  - Modern TAR tools can store high precision file times,     lengthy file names and large file sizes in special PAX     extended headers inside of TAR archive. Now WinRAR     supports such PAX headers and uses them when extracting     TAR archives.

  - unrar no longer fails to unpack files in ZIP archives     compressed with XZ algorithm and encrypted with AES

Version 5.4.5.

  - Based on final RAR 5.40.

  - If RAR recovery volumes (.rev files) are present in the     same folder as usual RAR volumes, archive test command     verifies .rev contents after completing testing .rar     files. If you wish to test only .rev files without     checking .rar volumes, you can run: `unrar t     arcname.part1.rev`.

  - If -p switch is used without optional <pwd> parameter, a     password can be also set with file redirection or pipe.

  - unrar treats 'arcname.partN' as 'arcname.partN.rar' if     'arcname.partN' does not exist and 'arcname.part#.rar'     exists. For example, it is allowed to run: `unrar x     arcname.part01` to start extraction from     'arcname.part01.rar'.

The remote host is affected by the vulnerability described in GLSA-201708-05 (RAR and UnRAR: User-assisted execution of arbitrary code)

    A VMSF_DELTA memory corruption was discovered in which an integer       overflow can be caused in DataSize+CurChannel. The result is a negative       value of the &ldquo;DestPos&rdquo; variable which allows writing out of bounds       when setting Mem[DestPos].
  Impact :

    A remote attacker, by enticing a user to open a specially crafted       archive, could execute arbitrary code with the privileges of the process.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of McAfee Web Gateway (MWG) that is affected by multiple security vulnerabilities :

  - A memory corruption flaw exists in unrar before 5.5.5, as used in     Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other     products that allows remote attackers to execute arbitrary code.
    (CVE-2012-6706)

  - A memory corruption flaw exists in Linux Kernel versions 4.11.5     and earlier that allows remote attacks to execute arbitrary code     with elevated privileges.(CVE-2017-1000364)

  - A memory corruption flaw exists in the handling of LD_LIBRARY_PATH     that allows a remote attacker to manipulate the heap/stack that     may lead to arbitrary code execution. This issue only affects GNU     glibc 2.25 and prior. (CVE-2017-1000366)

  - An input validation flaw exists in Todd Miller's sudo version     1.8.20p1 and earlier that results in information disclosure and     arbitrary command execution. (CVE-2017-1000368)

This update for clamav fixes the following security issue :

  - CVE-2012-6706: Fixed an arbitrary memory write in     VMSF_DELTA filter in libclamunrar (bsc#1045490)

This update was imported from the SUSE:SLE-12:Update update project.

This update for clamav fixes the following issues: Security issue fixed :

  - CVE-2012-6706: Fixed an arbitrary memory write in     VMSF_DELTA filter in libclamunrar (bsc#1045490) Non     security issue fixed :

  - Fix permissions of /var/spool/amavis. (bsc#815106)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for unrar fixes the following issues :

  - CVE-2012-6706: decoding malicious RAR files could have     lead to memory corruption or code execution.
    (bsc#1045315).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for clamav fixes the following issues: Security issue fixed :

  - CVE-2012-6706: Fixed an arbitrary memory write in     VMSF_DELTA filter in libclamunrar (bsc#1045490) Non     security issues fixed :

  - Provide and obsolete clamav-nodb to trigger its removal     in openSUSE Leap. (bsc#1040662)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was reported that unrar fixed a VMSF_DELTA memory corruption issue in their latest version unrarsrc-5.5.5.tar.gz. This problem was reported to Sophos AV in 2012 but never reach upstream rar.

For Debian 7 'Wheezy', these problems have been fixed in version 1:4.1.4-1+deb7u2.

We recommend that you upgrade your unrar-nonfree packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
152833	SUSE SLED12 / SLES12 Security Update : unrar (SUSE-SU-2021:2834-1)	Nessus	SuSE Local Security Checks	critical
109230	GLSA-201804-16 : ClamAV: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
108829	SUSE SLES11 Security Update : clamav (SUSE-SU-2018:0863-1)	Nessus	SuSE Local Security Checks	critical
108828	SUSE SLES11 Security Update : unrar (SUSE-SU-2018:0862-1)	Nessus	SuSE Local Security Checks	critical
108652	SUSE SLED12 / SLES12 Security Update : clamav (SUSE-SU-2018:0809-1)	Nessus	SuSE Local Security Checks	critical
108637	openSUSE Security Update : clamav (openSUSE-2018-314)	Nessus	SuSE Local Security Checks	critical
108601	Amazon Linux AMI : clamav (ALAS-2018-976)	Nessus	Amazon Linux Local Security Checks	critical
108311	Fedora 26 : clamav (2018-d2b08aa37f)	Nessus	Fedora Local Security Checks	critical
107169	Fedora 27 : clamav (2018-602b5345fa)	Nessus	Fedora Local Security Checks	critical
104064	GLSA-201710-21 : Kodi: Arbitrary code execution	Nessus	Gentoo Local Security Checks	critical
103463	GLSA-201709-24 : RAR, UnRAR: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
103163	openSUSE Security Update : unrar (openSUSE-2017-724)	Nessus	SuSE Local Security Checks	critical
102617	GLSA-201708-05 : RAR and UnRAR: User-assisted execution of arbitrary code	Nessus	Gentoo Local Security Checks	critical
102496	McAfee Web Gateway 7.6.x < 7.6.2.15 / 7.7.x < 7.7.2.3 Multiple Vulnerabilities (SB10205)	Nessus	Misc.	critical
101277	openSUSE Security Update : clamav (openSUSE-2017-779)	Nessus	SuSE Local Security Checks	critical
101222	SUSE SLES11 Security Update : clamav (SUSE-SU-2017:1763-1)	Nessus	SuSE Local Security Checks	critical
101221	SUSE SLES11 Security Update : unrar (SUSE-SU-2017:1760-1)	Nessus	SuSE Local Security Checks	critical
101204	SUSE SLED12 / SLES12 Security Update : unrar (SUSE-SU-2017:1745-1)	Nessus	SuSE Local Security Checks	critical
101143	SUSE SLED12 / SLES12 Security Update : clamav (SUSE-SU-2017:1716-1)	Nessus	SuSE Local Security Checks	critical
101065	Debian DLA-1003-1 : unrar-nonfree security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2012-6706

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical