Cloudanix VulnDB

CVE-2024-33899

High · 7.1

CVSS

7.1

EPSS

0.8%

Published

Apr 29, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in an older version of a popular file compression tool on certain systems can let attackers trick users by changing what's shown on screen or temporarily stop the tool from working.

Exploitation
Requires User Interaction
Attacker needs
Low Privilege
Complexity
High
Impact
Data Tampering
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability permits malicious ANSI escape sequences embedded in archive metadata or file names to manipulate terminal output or disrupt the application on Linux and UNIX systems.

Why it matters to the business

Attackers could deceive users into performing unintended actions or cause temporary unavailability of the file extraction tool, potentially leading to operational disruptions in environments relying on WinRAR for archive handling.

How an attack unfolds

An attacker creates a specially crafted RAR archive containing ANSI escape sequences. When a user extracts or lists the archive contents using an affected WinRAR version on Linux or UNIX, the sequences alter the displayed output or trigger a denial of service.

How to fix it

Upgrade WinRAR to version 7.00 or later on Linux and UNIX platforms to prevent processing of harmful ANSI sequences.

How to confirm the fix worked

Verify the installed WinRAR version is 7.00 or higher and test extraction of archives with ANSI sequences in a controlled environment to confirm no output manipulation occurs.

Typical attack path

  1. Craft a RAR archive with embedded ANSI escape sequences in file names or comments
  2. Distribute the archive to the target via email or download
  3. Victim opens or extracts the archive using vulnerable WinRAR
  4. ANSI sequences execute in the terminal, spoofing output or causing DoS

How to detect it

Review terminal logs or session recordings for unexpected escape sequence effects during archive extraction; check application logs for crashes or abnormal behavior associated with RAR file processing.

What your security team should do

  • Prioritize updating all instances of WinRAR to version 7.00 or newer
  • Educate users on risks of opening untrusted archives
  • Monitor for any unusual terminal behavior during archive operations

The record

RARLAB WinRAR before 7.00, on Linux and UNIX platforms, allows attackers to spoof the screen output, or cause a denial of service, via ANSI escape sequences.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 rar 0 No fix
Debian:11 unrar-nonfree 0 No fix
Debian:12 rar 0 No fix
Debian:12 unrar-nonfree 0 No fix
Debian:13 rar 0 2:7.00-1
Debian:13 unrar-nonfree 0 1:7.0.3-1
Debian:14 rar 0 2:7.00-1
Debian:14 unrar-nonfree 0 1:7.0.3-1
SUSE:Linux Enterprise Server 12 SP5 unrar 0 5.6.1-4.11.1
SUSE:Linux Enterprise Server for SAP Applications 12 SP5 unrar 0 5.6.1-4.11.1
SUSE:Linux Enterprise Software Development Kit 12 SP5 unrar 0 5.6.1-4.11.1
Ubuntu:16.04:LTS unrar-nonfree 0 No fix
Ubuntu:18.04:LTS unrar-nonfree 0 No fix
Ubuntu:20.04:LTS unrar-nonfree 0 No fix
Ubuntu:20.04:LTS unrar-nonfree 0 1:5.6.6-2ubuntu0.1
Ubuntu:22.04:LTS unrar-nonfree 0 No fix
Ubuntu:22.04:LTS unrar-nonfree 0 1:6.1.5-1ubuntu0.1
Ubuntu:24.04:LTS unrar-nonfree 0 No fix
Ubuntu:24.10 unrar-nonfree 0 No fix
Ubuntu:Pro:16.04:LTS unrar-nonfree 0 No fix
Ubuntu:Pro:18.04:LTS unrar-nonfree 0 No fix

Related vulnerabilities