Description
Integer signedness error in the SET_VALUE function in rarvm.cpp in unrar 3.70 beta 3, as used in products including WinRAR and RAR for OS X, allows user-assisted remote attackers to cause a denial of service (crash) via a crafted RAR archive that causes a negative signed number to be cast to a large unsigned number.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rar | 1:3.7b1-1 | — |
| Debian 14 | unrar-nonfree | 3.7.3-1.1 | — |
| Debian 13 | rar | 1:3.7b1-1 | — |
| Debian 13 | unrar-nonfree | 3.7.3-1.1 | — |
| Debian 12 | rar | 1:3.7b1-1 | — |
| Debian 12 | unrar-nonfree | 3.7.3-1.1 | — |
References
- 20070711 RE: Advisory - Clam AntiVirus RAR File Handling Denial Of Service Vulnerability. mailing-list
- 20070731 FLEA-2007-0037-1 unrar mailing-list
- 39603 vdb-entry
- 20070711 Advisory - Clam AntiVirus RAR File Handling Denial Of Service Vulnerability. mailing-list
- 2880 third-party-advisory
- 20070711 Re: Advisory - Clam AntiVirus RAR File Handling Denial Of Service Vulnerability. mailing-list