salawalas |
01.08.2006 10:40 |
Choćby dziury załatać:
July 25, 2006 - Several vulnerabilities have been discovered in WinRar which could be exploited to execute arbitrary code and compromise system security. Users of this tool are advised to update to the latest version to correct these security problems.
WinRAR is a popular file compression tool for Windows which supports, among others, the following formats: RAR, ZIP, CAB, ARJ, LZH, TAR, GZ, and ACE.
Two stack overflow vulnerabilities have recently been detected in the modules that process LZH and SFX formats.
An attacker could construct a compressed file based on LZH or SFX and send it to a potential victim with a vulnerable version of WinRAR installed. The stack overflow and execution of arbitrary code would occur on opening and extracting the file, leaving the system vulnerable to any action.
The vulnerability in the LZH module was corrected in WinRAR 3.60 beta 7, and then version 3.60 beta 8 was published to correct the problem in the SFX module, as explained at: http://www.rarlab.com/rarnew.htm
All affected users with a 3.x version of WinRAR are advised to install the latest update, WinRAR 3.60 beta 8, available at http://www.rarlab.com/download.htm
Za : http://secunia.com/advisories/21080/
|