CVE-2018-20251: check point software technologies ltd. winrar Protection Mechanism Failure

Vulnerability summary

CVE-2018-20251 is a medium (CVSS 5.5) Protection Mechanism Failure vulnerability in check point software technologies ltd. winrar. EPSS estimates a 31.40% chance of exploitation in the next 30 days, higher than 98.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-02-2019
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

In WinRAR versions prior to and including 5.61, there is path traversal vulnerability when crafting the filename field of the ACE format. The UNACE module (UNACEV2.dll) creates files and folders as written in the filename field even when WinRAR validator noticed the traversal attempt and requestd to abort the extraction process. the operation is cancelled only after the folders and files were created but prior to them being written, therefore allowing the attacker to create empty files and folders everywhere in the file system.

• CWE-693Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.