Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA11427
HistoryFeb 05, 2019 - 12:00 a.m.

KLA11427 Multiple ACE vulnerabilities in WinRAR

2019-02-0500:00:00
Kaspersky Lab
threats.kaspersky.com
669

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.974 High

EPSS

Percentile

99.9%

JSON

Detect date:

02/05/2019

Severity:

Critical

Description:

Multiple vulnerabilities were found in WinRAR. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions.

Affected products:

WinRAR 5.x earlier than 5.70

Solution:

Update to the latest version
WinRAR and RAR archiver downloads

Original advisories:

Extracting a 19 Year Old Code Execution from WinRAR
Security Week 09

Impacts:

ACE

Related products:

WinRAR

CVE-IDS:

CVE-2018-202506.8High
CVE-2018-202514.3Warning
CVE-2018-202526.8High
CVE-2018-202536.8High

Exploitation:

Public exploits exist for this vulnerability.

Related

threatpost 3
myhack58 1
nessus 1
cvelist 4
cve 4
prion 4
thn 3
attackerkb 1
malwarebytes 1
zdt 2
openvas 2
checkpoint_advisories 1
fireeye 2
cisa_kev 1
talosblog 1
packetstorm 1
mssecure 2
securelist 2
cisa 1
qualysblog 1
threatpost
threatpost
19-Year-Old WinRAR Flaw Plagues 500 Million Users
2019-02-21 15:05:45
Cybercriminals Have a Heyday with WinRAR Bug in Fresh Campaigns
2019-03-27 15:26:00
Critical WinRAR Flaw Found Actively Being Exploited
2019-02-26 14:51:04
myhack58
myhack58
WinRAR aeration elder has a major vulnerability that hackers can be malicious programs implanted in the boot process-vulnerability warning-the black bar safety net
2019-02-22 00:00:00
nessus
nessus
RARLAB WinRAR < 5.70 Beta 1 Multiple Vulnerabilities
2019-02-27 00:00:00
cvelist
cvelist
CVE-2018-20253
2019-02-13 01:00:00
CVE-2018-20252
2019-02-05 00:00:00
CVE-2018-20250
2019-02-05 00:00:00
cve
cve
CVE-2018-20253
2019-02-13 01:29:00
CVE-2018-20252
2019-02-05 20:29:00
CVE-2018-20251
2019-02-05 20:29:00
prion
prion
Out-of-bounds
2019-02-05 20:29:00
Out-of-bounds
2019-02-13 01:29:00
Path traversal
2019-02-05 20:29:00
thn
thn
Patched WinRAR Bug Still Under Active Attack—Thanks to No Auto-Updates
2019-03-15 08:00:00
Elfin Hacking Group Targets Multiple U.S. and Saudi Arabian Firms
2019-03-28 08:18:00
Latest WinRAR Flaw Being Exploited in the Wild to Hack Windows Computers
2019-02-26 13:40:00
attackerkb
attackerkb
CVE-2018-20250
2019-02-05 00:00:00
malwarebytes
malwarebytes
A week in security (March 11 – 17)
2019-03-18 14:57:10
zdt
zdt
WinRAR 5.61 - Path Traversal Exploit
2019-03-18 00:00:00
RARLAB WinRAR ACE Format Input Validation Remote Code Execution Exploit
2019-04-24 00:00:00
openvas
openvas
WinRAR <= 5.60 Out-of-Bounds Write Vulnerability
2019-03-06 00:00:00
WinRAR <= 5.61 Absolute Path Traversal Vulnerability
2022-08-12 00:00:00
checkpoint_advisories
checkpoint_advisories
RARLAB WinRaR ACE Format Input Validation Remote Code Execution (CVE-2018-20250)
2019-02-13 00:00:00
fireeye
fireeye
WinRAR Zero-day Abused in Multiple Campaigns
2019-03-26 15:30:00
Think Fast: Time Between Disclosure, Patch Release and Vulnerability Exploitation — Intelligence for Vulnerability Management, Part Two
2020-04-13 00:00:00
cisa_kev
cisa_kev
WinRAR Absolute Path Traversal Vulnerability
2022-02-15 00:00:00
talosblog
talosblog
What the continued escalation of tensions in the Middle East means for security
2020-01-09 10:13:06
packetstorm
packetstorm
RARLAB WinRAR ACE Format Input Validation Remote Code Execution
2019-04-24 00:00:00
mssecure
mssecure
Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint
2020-06-18 16:00:03
Analysis of a targeted attack exploiting the WinRAR CVE-2018-20250 vulnerability
2019-04-10 15:00:58
securelist
securelist
IT threat evolution Q1 2019
2019-05-23 10:00:14
IT threat evolution Q1 2019. Statistics
2019-05-23 10:00:53
cisa
cisa
CISA Adds Nine Known Exploited Vulnerabilities to Catalog
2022-02-15 00:00:00
qualysblog
qualysblog
Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking
2019-12-27 18:01:22

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.974 High

EPSS

Percentile

99.9%

JSON
Related for KLA11427
threatpost3myhack581nessus1cvelist4cve4prion4thn3attackerkb1malwarebytes1zdt2openvas2checkpoint_advisories1fireeye2cisa_kev1talosblog1packetstorm1mssecure2securelist2cisa1qualysblog1