CVE-2022-30333

RARLAB UnRAR Directory Traversal Vulnerability

Unrar

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

9. Mai 2022

Ausgewertete Quellen

• Debian
  https://lists.debian.org/debian-lts-announce/2023/08/msg00022.html
• Hinweis
  http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html
• Hinweis
  https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/
• Hinweis
  https://security.gentoo.org/glsa/202309-04
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30333
• CISA
  RARLAB UnRAR Directory Traversal Vulnerability
• NVD
  CVE-2022-30333