CVE-2005-0331: Low severity RARLAB WinRAR vulnerability
Published Feb 10, 2005
·Updated
Directory traversal vulnerability in WinRAR 3.42 and earlier, when the user clicks on the ZIP file to extract it, allows remote attackers to create arbitrary files via a ... (triple dot) in the filename of the ZIP file.
Affected Software
9 affected components
RARLAB WinRAR=3.0.0
RARLAB WinRAR=3.10
RARLAB WinRAR=3.10_beta3
RARLAB WinRAR=3.10_beta5
RARLAB WinRAR=3.11
RARLAB WinRAR=3.20
RARLAB WinRAR=3.40
RARLAB WinRAR=3.41
RARLAB WinRAR=3.42
Event History
Feb 10, 2005
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-0331?
CVE-2005-0331 is considered a medium severity vulnerability due to the potential for file creation exploits.
2
How do I fix CVE-2005-0331?
To fix CVE-2005-0331, users should upgrade to a version of WinRAR later than 3.42.
3
What is the impact of CVE-2005-0331?
The impact of CVE-2005-0331 allows remote attackers to create arbitrary files on the user's system.
4
Which versions of WinRAR are affected by CVE-2005-0331?
CVE-2005-0331 affects WinRAR versions 3.42 and earlier.
5
Is CVE-2005-0331 a directory traversal vulnerability?
Yes, CVE-2005-0331 is a directory traversal vulnerability that exploits the ZIP file extraction process.