Tag: RCE | Page 3

RCE Vulnerability In UnRAR Library Affected Zimbra Platform

July 9, 2022/in Internet Security

A severe remote code execution vulnerability affected the Zimbra email client. The bug typically existed in the UnRAR library that could trigger RCE on the Zimbra platform. Thankfully, the bug received a fix before malicious exploitation.

Zimbra UnRAR Library Vulnerability

Researchers from Sonar recently shared insights about a severe security flaw affecting the Zimbra email platform.

Specifically, the researchers found a zero-day vulnerability in a third-party UnRAR utility used in Zimbra that could trigger RCE. Exploiting the bug didn’t even require authentication. Describing the bug, CVE-2022-30333, the file write vulnerability in the RarLab’s unrar binary, the researchers stated,

An attacker is able to create files outside of the target extraction directory when an application or victim user extracts an untrusted archive. If they can write to a known location, they are likely to be able to leverage it in a way leading to the execution of arbitrary commands on the system.

Although, the bug didn’t directly affect Zimbra. Nonetheless, exploiting it could let an attacker access the sent and received emails on the compromised email server. An adversary could also deploy backdoors on compromised servers, steal credentials and other data, and gain access to other unauthorized areas on the network. Such explicit access became possible due to the unhindered permissions to UnRar utility for Zimbra.

The researchers have shared the technical details of the vulnerability in their post.

Patch Deployed

Following this discovery, Sonar researchers reported the matter to RarLab, and “gave a heads-up” to Zimbra for an upcoming fix.

Eventually, RarLab patched the vulnerability with UnRar binary version 6.12. Hence, all UnRar utility users should get this patched version or later to receive the fix.

Besides, Zimbra also addressed the glitch by configuring 7z as default for extracting RAR archives by Amavis instead of UnRar.

Let us know your thoughts in the comments.

Source…

Dark Souls 3 & Elden Ring “doomsday scenario” RCE hack discovered

January 23, 2022/in Computer Security

A startling discovery took place on Friday, after a streamer was a victim of what appears to be a Remote Code Execution (RCE) attack in Dark Souls 3 live on stream. In the clip, the streamer experiences a hack that can be seen crashing his game, after which Powershell reportedly opened up and ran a script that trash-talked the player using Microsoft text-to-speech.

According to a message linked in the SpeedSouls Discord server, only one non-malicious person to public knowledge currently knows how to execute this code, and they are working to bring attention to the developers regarding this issue. The hack has been demonstrated but is not widespread yet.

In that message referenced in the server, a user who goes by the name Princess Slut stated: “A person who isn’t malicious discovered a new RCE method, and tried to contact From about it through multiple channels. They ignored him. In an attempt to raise awareness to it so that it would be fixed (as this is a SEVERE security flaw), he did a live benign showcase on stream. It didn’t leak. Nobody has it beside him.”

Princess Slut continued: “He is in contact with sfix so we can fix it on [Blue Sentinel] but this isn’t ideal, as the base product is insecure. We’re also thinking about Elden Ring as it will have that exploit as well. The attempts to get From’s attention and get an official fix for their exploits is what drives most of us.”

An IT specialist I talked to about the potential for this type of hack said: “This is literally the doomsday scenario, someone could completely destroy your computer beyond repair with this exploit… If people can run code on your computer, it is over, they can do anything they want.”

Among the things that hackers could carry out with an RCE exploit are:

Bricking your PC entirely
Stealing sensitive data and passwords stored on your PC
Executing malware on your PC
Using your PC to mine crypto-currency
Pretty much anything you can think of

We don’t know the extent of the RCE, is it probable that they can elevate permissions on the PC. It isn’t confirmed they can, but it is likely, according to experts I talked to…

Source…