Bug 218064 - app-arch/unrar-gpl <0.0.1_p20080417 : rar overflow (CVE-2008-1837)
Bug#: 218064 (CVE-2008-1837) Product:  Gentoo Security Version: unspecified Platform: All
OS/Version: Linux Status: RESOLVED Severity: normal Priority: P2
Resolution: INVALID Assigned To: security@gentoo.org Reported By: hanno@gentoo.org
Component: Vulnerabilities
URL: 
Summary: app-arch/unrar-gpl <0.0.1_p20080417 : rar overflow (CVE-2008-1837)
Keywords:  
Status Whiteboard: B2 [noglsa]
Opened: 2008-04-17 08:16 0000
Description:   Opened: 2008-04-17 08:16 0000 
unrar-gpl shares code from libclamav, thus is also affected by CVE-2008-1837.

I can't reproduce the issue on current cvs snapshot (just committed), thus I
assume it's safe, although it hasn't seen any updates recently.

------- Comment #1 From Markus Meier 2008-04-17 21:43:07 0000 ------- 
amd64/x86 stable, last arches.

------- Comment #2 From Robert Buchholz 2008-04-18 00:03:16 0000 ------- 
Hanno, can you please confirm that this is actually fixed? What makes me wonder
is that the last CVS commit is 7 months old, and the latest affected clamav
version was released only 2 months ago.

------- Comment #3 From Hanno Boeck 2008-04-18 10:53:20 0000 ------- 
rbu, I'm not really sure, I was wondering the same.

I wrote to the clamav-dev asking for the samples and he sent me three rar-files
crashing clamav < 0.93. All three don't crash latest unrar (while they crash
the older snapshot), so from my tests they are safe. I don't have an
explanation for that though.

------- Comment #4 From Robert Buchholz 2008-04-18 11:14:11 0000 ------- 
If you still have contact upstream, you could ask for the patch fixing
CVE-2008-1837.

------- Comment #5 From Robert Buchholz 2008-04-23 17:12:34 0000 ------- 
Hanno: The only difference between the two versions you tried was removing
"unrar30" code, which is removed from the upstream libclamav for some time. The
diff that is called "check in 0.93 patches" is this:
http://svn.clamav.net/websvn/comp.php?repname=clamav-devel&path=&compare%5B%5D=%2Ftrunk%2Flibclamunrar%2F@3787&compare%5B%5D=%2Ftrunk%2Flibclamunrar%2F@3788

------- Comment #6 From Pierre-Yves Rofes 2008-05-05 21:26:54 0000 ------- 
any news here?

------- Comment #7 From Robert Buchholz 2008-11-26 18:10:54 0000 ------- 
revisiting this bug I noticed that the libclamav code is actually not used
within unrar-gpl. The unrar20.* unrar15.* and unrar29.* files are derived from
libclamav, but you can simply delete them without any effect. The rar code
actually used is the one from unrarlib.