Risk: | high |
Damage: |
high |
Platform(s): |
Microsoft® Windows OS |
Advisory ID: |
ngCERT-2019-0006 |
Version: |
1.00 |
CVE: |
CVE-2019-557 |
Published: |
July 21, 2023 |
ngCERT Advisory 19-years-old WinRAR vulnerability leads to over 100 malware exploits
OVERVIEW WinRAR is a trialware file archiver utility for Windows which can create and view archives in RAR or ZIP file formats and unpack numerous archive file formats. Description and Consequences According to the WinRAR website, over 500 million users worldwide make WinRAR the world’s most popular compression too. While a patched version, 5.70, was released on February 26, attackers are releasing exploits in an effort to reach vulnerable systems before they can be patched, when a vulnerable version of WinRAR is used to extract the contents of this archive, a malicious payload is created in the Startup folder behind the scenes. User Account Control (UAC) does not apply, so no alert is displayed to the user. The next time the system restarts, the malware is run.
To create an exploit file, which causes WinRAR to extract an archived file to an arbitrary path (Path Traversal), extract to the Startup Folder (which gains code execution after reboot) instead of to the destination folder. We should bypass two filter functions to trigger the bug. To trigger the concatenation of an empty string to the relative path of the compressed file, instead of the destination folder: Note: However, there is a callback function in WinRAR code that is used as a validator/filter function. During the extraction process, unacev2.dll is called to the callback function that resides in the WinRAR code. The callback function validates the relative path of the compressed file. If the blacklist sequence is found, the extraction operation will be aborted.
ESXi Remote Code Execution Vulnerability
Investigation revealed that the vulnerability ESXi versions 6.0, 6.5 and 6.7 running on any platform, and the Horizon cloud desktop-as-a-service (DaaS) platform version 8.x. could be exploited to perform remote code execution.
A vulnerability in the REST API of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) releases prior to 3.0.2 could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the underlying operating system.
ngCERT Advisory on Scranos Malware
Scranos is a Trojan horse that steals information from the compromised computer. It may also download potentially malicious files. Scranos cloaks itself as cracked software or apps that pose as legitimate programs, such as ebook readers, video players, drivers, and even security products. Upon execution, a rootkit driver is installed to hide the malware.
Windows 10 Task Scheduler Zero-Day Vulnerability
Microsoft Windows Task Scheduler is a set of Microsoft Windows components that allows for the execution of scheduled tasks. The exploit "functions reliably on 32- and 64-bit Windows 10 platforms, as well as Windows Server 2016 and Windows Server 2019.
Millions of computers powered by Intel processors are affected by vulnerabilities that can be exploited by malicious actors to obtain potentially sensitive information. The side-channel attack methods, named ZombieLoad, Rogue In-Flight Data Load,(RIDL) and Fallout, are similar to the notorious Meltdown and Spectre. The attack methods work against both PCs and cloud environments, and they can be launched against most Intel CPUs.
Windows BlueKeep Vulnerability
BlueKeep Vulnerability exists within the Remote Desktop Protocol (RDP) used by the Microsoft Windows Operating Systems (OSs). An attacker can exploit this vulnerability to perform remote code execution on an unprotected system.
ngCERT Advisory 19-years-old WinRAR vulnerability leads to over 100 malware exploits
ngCERT Advisory 19-years-old WinRAR vulnerability leads to over 100 malware exploits
ngCERT Advisory Microsoft Exchange 2013 and Newer are vulnerable to NTLM relay attacks
ngCERT Advisory Microsoft Exchange 2013 and Newer are vulnerable to NTLM relay attacks