Extracting a 19 Year Old Code Execution from WinRAR - https://research.checkpoint.com/extract ... om-winrar/
Attackers Exploiting WinRAR UNACEV2.DLL Vulnerability (CVE-2018-20250) - https://securingtomorrow.mcafee.com/oth ... 018-20250/
Possibly the first malware delivered through mail to exploit WinRAR vulnerability - https://twitter.com/360TIC/status/1099987939818299392
upgrades in winrar exploit with social engineering and encryption - https://twitter.com/360TIC/status/1100738261830397952
CVE-2018-20250 exp - https://github.com/WyAtu/CVE-2018-20250
https://www.virustotal.com/en/file/7871 ... 552429820/
https://www.virustotal.com/en/file/6420 ... 552149551/
and additionally: viewtopic.php?f=21&t=5453
edit: as it seem to rain samples here is a generic rule:
Attackers Exploiting WinRAR UNACEV2.DLL Vulnerability (CVE-2018-20250) - https://securingtomorrow.mcafee.com/oth ... 018-20250/
Possibly the first malware delivered through mail to exploit WinRAR vulnerability - https://twitter.com/360TIC/status/1099987939818299392
upgrades in winrar exploit with social engineering and encryption - https://twitter.com/360TIC/status/1100738261830397952
CVE-2018-20250 exp - https://github.com/WyAtu/CVE-2018-20250
https://www.rarlab.com/rarnew.htm wrote: Version 5.70Samples from twitter links in attach.
21. Nadav Grossman from Check Point Software Technologies informed us
about a security vulnerability in UNACEV2.DLL library.
Aforementioned vulnerability makes possible to create files
in arbitrary folders inside or outside of destination folder
when unpacking ACE archives.
WinRAR used this third party library to unpack ACE archives.
UNACEV2.DLL had not been updated since 2005 and we do not have access
to its source code. So we decided to drop ACE archive format support
to protect security of WinRAR users.
We are thankful to Check Point Software Technologies for reporting
this issue.
https://www.virustotal.com/en/file/7871 ... 552429820/
https://www.virustotal.com/en/file/6420 ... 552149551/
and additionally: viewtopic.php?f=21&t=5453
edit: as it seem to rain samples here is a generic rule:
Code: Select all
rule CVE_2018_20250 : AceArchive UNACEV2_DLL_EXP
{
meta:
description = "Generic rule for hostile ACE archive using CVE-2018-20250"
author = "xylitol@temari.fr"
date = "2019-03-17"
reference = "https://research.checkpoint.com/extracting-code-execution-from-winrar/"
// May only the challenge guide you
strings:
$string1 = "**ACE**" ascii wide
$string2 = "*UNREGISTERED VERSION*" ascii wide
// $hexstring1 = C:\C:\
$hexstring1 = {?? 3A 5C ?? 3A 5C}
// $hexstring2 = C:\C:C:..
$hexstring2 = {?? 3A 5C ?? 3A ?? 3A 2E}
condition:
$string1 at 7 and $string2 at 31 and 1 of ($hexstring*)
}Attachments
infected
(5.62 MiB) Downloaded 35 times
(5.62 MiB) Downloaded 35 times
infected
(71.24 KiB) Downloaded 35 times
(71.24 KiB) Downloaded 35 times
