CVE-2014-9983: Path Traversal
First published: Mon Dec 29 2014(Updated: )
Directory Traversal exists in RAR 4.x and 5.x because an unpack operation follows any symlinks, including symlinks contained in the archive. This allows remote attackers to write to arbitrary files via a crafted archive.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/rar | <=2:4.2.0-1<=2:5.2.1b2-1 | |
| WinRAR | =4.00 | |
| WinRAR | =4.01 | |
| WinRAR | =4.10 | |
| WinRAR | =4.11 | |
| WinRAR | =4.20 | |
| WinRAR | =5.00 | |
| WinRAR | =5.01 | |
| WinRAR | =5.10 | |
| WinRAR | =5.11 | |
| WinRAR | =5.20 | |
| WinRAR | =5.21 | |
| WinRAR | =5.30 | |
| WinRAR | =5.31 | |
| WinRAR | =5.40 | |
| WinRAR | =5.50 | |
| WinRAR | =5.50-beta1 | |
| WinRAR | =5.50-beta2 | |
| WinRAR | =5.50-beta3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2014-9983?
CVE-2014-9983 is considered a critical vulnerability due to its potential to allow remote attackers to write to arbitrary files on the system.
How do I fix CVE-2014-9983?
To mitigate CVE-2014-9983, update RAR to the latest version that does not include this vulnerability.
Which versions are affected by CVE-2014-9983?
CVE-2014-9983 affects RAR versions 4.0 to 5.50 beta3.
What type of vulnerability is CVE-2014-9983?
CVE-2014-9983 is classified as a directory traversal vulnerability.
Can CVE-2014-9983 be exploited remotely?
Yes, CVE-2014-9983 can be exploited remotely via a crafted archive that contains symlinks.
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/debian-bugs
- source/Debian
- alias/CVE-2014-9983
- agent/software-canonical-lookup
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/weakness
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/debian
- vendor/rarlab
- canonical/winrar
- version/winrar/4.00
- version/winrar/4.01
- version/winrar/4.10
- version/winrar/4.11
- version/winrar/4.20
- version/winrar/5.00
- version/winrar/5.01
- version/winrar/5.10
- version/winrar/5.11
- version/winrar/5.20
- version/winrar/5.21
- version/winrar/5.30
- version/winrar/5.31
- version/winrar/5.40
- version/winrar/5.50
- version/winrar/5.50-beta1
- version/winrar/5.50-beta2
- version/winrar/5.50-beta3