rar: CVE-2014-9983: symlink directory traversal

Debian Bug report logs - #774172
rar: CVE-2014-9983: symlink directory traversal

Toggle useless messages

Message #3 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jakub Wilk <jwilk@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: rar: symlink directory traversal

Date: Mon, 29 Dec 2014 22:29:28 +0100

[Message part 1 (text/plain, inline)]

Package: rar
Version: 2:4.2.0-1
Tags: security

RAR follows symlinks when unpacking stuff, even the symlinks that were 
created during the same unpack process.
It is therefore possible to create a malicious RAR archive that will be 
unpacked into arbitrary directory outside cwd.

Proof of concept:

$ pwd
/home/jwilk

$ rar x traversal.rar

RAR 4.20   Copyright (c) 1993-2012 Alexander Roshal   9 Jun 2012
Trial version             Type RAR -? for help


Extracting from traversal.rar

Extracting  tmp                                                       OK
Extracting  tmp/moo                                                   OK
All OK

$ ls -l /tmp/moo
-rw-r--r-- 1 jwilk jwilk 4 Dec 29 21:41 /tmp/moo


-- System Information:
Debian Release: 8.0
 APT prefers unstable
 APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/1 CPU core)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

-- 
Jakub Wilk

[traversal.rar (application/rar, attachment)]

Message #10 received at 774172@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: 774172@bugs.debian.org

Cc: jwilk@debian.org

Subject: Re: rar: symlink directory traversal

Date: Tue, 27 Dec 2016 16:18:53 +0100

On Mon, Dec 29, 2014 at 10:29:28PM +0100, Jakub Wilk wrote:
> Package: rar
> Version: 2:4.2.0-1
> Tags: security
> 
> RAR follows symlinks when unpacking stuff, even the symlinks that were
> created during the same unpack process.
> It is therefore possible to create a malicious RAR archive that will be
> unpacked into arbitrary directory outside cwd.

What't the status? This bug hasn't seen maintainer acknowledgement in
two years?

Cheers,
        Moritz

Message #15 received at 774172@bugs.debian.org (full text, mbox, reply):

From: Martin Meredith <martin@sourceguru.net>

To: 774172@bugs.debian.org, Moritz Mühlenhoff <jmm@inutil.org>

Subject: Re: Bug#774172: rar: symlink directory traversal

Date: Tue, 27 Dec 2016 15:24:03 +0000

[Message part 1 (text/plain, inline)]

This has been passed on upstream, with no responses as it should have been
marked.

On 27 Dec 2016 3:21 p.m., "Moritz Mühlenhoff" <jmm@inutil.org> wrote:

> On Mon, Dec 29, 2014 at 10:29:28PM +0100, Jakub Wilk wrote:
> > Package: rar
> > Version: 2:4.2.0-1
> > Tags: security
> >
> > RAR follows symlinks when unpacking stuff, even the symlinks that were
> > created during the same unpack process.
> > It is therefore possible to create a malicious RAR archive that will be
> > unpacked into arbitrary directory outside cwd.
>
> What't the status? This bug hasn't seen maintainer acknowledgement in
> two years?
>
> Cheers,
>         Moritz
>

[Message part 2 (text/html, inline)]

Message #26 received at 774172-done@bugs.debian.org (full text, mbox, reply):

From: Martin Meredith <mez@debian.org>

To: 774172-done@bugs.debian.org, control@bugs.debian.org

Subject: Seems to be patched

Date: Tue, 29 Aug 2017 11:25:37 +0100

[Message part 1 (text/plain, inline)]

fixed 2:5.4.0+dfsg.1-0.1
thanks

Just looking over this - and I can't reproduce this in in current versions.

I'm closing this - but please, feel free to re-open and send me further
details if there's a further fix.

[Message part 2 (text/html, inline)]

Message #33 received at 774172@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Martin Meredith <martin@sourceguru.net>, 774172@bugs.debian.org

Cc: Moritz Mühlenhoff <jmm@inutil.org>

Subject: Re: Bug#774172: rar: symlink directory traversal

Date: Tue, 29 Aug 2017 21:08:13 +0200

This should be fixed in 5.21 upstream:

+   Version 5.21
+
+   1. While previous versions could produce RAR5 volumes of slightly
+      smaller than requested size sometimes, such situation is less
+      likely now. In most cases volume size equals to specified by user.
+
+   2. Now by default RAR skips symbolic links with absolute paths
+      in link target when extracting. You can enable creating such links
+      with -ola switch.
+
+      Such links pointing to directories outside of extraction destination
+      directory can present a security risk. Enable their extraction only
+      if you are sure that archive contents is safe, such as your own backup.

the first version in unstable containging the fix should be 2:5.3.b2-1.

Regards,
Salvatore

Send a report that this bug log contains spam.