Bug 843611 – <app-arch/unrar-6.1.7: extract directory traversal/file overwrite

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description John Helmert III 2022-05-10 15:06:17 UTC]

CVE-2022-30333 (https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz):
https://www.rarlab.com/rar_add.htm

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

References seem useless, and CVE descriptions aren't reliable. It
should be verified that 6.12 actually fixes the issue. Since the
description doesn't mention it, app-arch/unar should probably be
checked as well.

[Comment 1 Larry the Git Cow 2022-05-31 03:10:03 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=abe68f25a84bae5737dbd9b2c3f513c58c993d16

commit abe68f25a84bae5737dbd9b2c3f513c58c993d16
Author:     Sam James <[e-mail]>
AuthorDate: 2022-05-31 03:01:44 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2022-05-31 03:01:44 +0000

    app-arch/unrar: add 6.1.7
    
    Bug: https://bugs.gentoo.org/843611
    Signed-off-by: Sam James <[e-mail]>

 app-arch/unrar/Manifest           |  1 +
 app-arch/unrar/unrar-6.1.7.ebuild | 65 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 66 insertions(+)

[Comment 2 John Helmert III 2022-06-02 06:13:23 UTC]

Please cleanup

[Comment 3 John Helmert III 2022-06-04 15:55:59 UTC]

*** Bug 849686 has been marked as a duplicate of this bug. ***

[Comment 4 Matt Turner 2023-06-04 18:09:28 UTC]

Clean.

[Comment 5 John Helmert III 2023-06-12 04:25:31 UTC]

Thanks!

[Comment 6 John Helmert III 2023-06-13 04:14:22 UTC]

GLSA request filed

[Comment 7 Larry the Git Cow 2023-09-17 05:26:31 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=2cdd606244f7dd25e671800d5ab92a7e8d6990eb

commit 2cdd606244f7dd25e671800d5ab92a7e8d6990eb
Author:     GLSAMaker <[e-mail]>
AuthorDate: 2023-09-17 05:24:38 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-09-17 05:26:26 +0000

    [ GLSA 202309-04 ] RAR, UnRAR: Arbitrary File Overwrite
    
    Bug: https://bugs.gentoo.org/843611
    Bug: https://bugs.gentoo.org/849686
    Signed-off-by: GLSAMaker <[e-mail]>
    Signed-off-by: Sam James <[e-mail]>

 glsa-202309-04.xml | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)