full-disclosure

Open Source and information security mailing list archives

Date: Mon, 5 Sep 2016 18:17:57 +0200
From: Rio Sherri <rio.sherri@...nstudent.info>
To: fulldisclosure <fulldisclosure@...lists.org>
Subject: [FD] Unrar 0.0.1 Memory Corruption

# Title : Unrar 0.0.1 Memory Corruption
# Date : 05/09/2016
# Author : R-73eN
# Tested on : Linux VM 2.6.38-8-generic #42-Ubuntu SMP Mon Apr 11 03:31:50
UTC 2011 i686 i686 i386 GNU/Linux
# Software : https://github.com/defiant-labs/unrar-free

root@VM:~/unrar-free/src# unrar --version
unrar 0.0.1
root@VM:~/unrar-free/src# gdb --args ./unrar ~/test.rar
GNU gdb (Ubuntu/Linaro 7.2-1ubuntu11) 7.2
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html
>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /root/unrar-free/src/unrar...done.
(gdb) run
Starting program: /root/unrar-free/src/unrar /root/test.rar

unrar 0.0.1  Copyright (C) 2004  Ben Asselstine, Jeroen Dekkers

Extracting from /root/test.rar

Program received signal SIGSEGV, Segmentation fault.
0x08050e2e in DecodeNumber (Deco=0x8066c20) at unrarlib.c:1653
1653  if (N < Deco->DecodeLen[8])

The document that crashes the unrar is attached.

View attachment "unrar vulnerability.txt" of type "text/plain" (1547 bytes)

Download attachment "crash.rar" of type "application/rar" (92 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives