High severity vuln in WinRAR could allow code to run when files are opened
- Reference: 1692624906
- News link: https://www.theregister.co.uk/2023/08/21/winrar_vuln_could_allow_code/
- Source link:
WinRAR is one of the many apps available for compressing and packaging multiple files together for distribution or archiving, and is claimed as the world’s most popular compression tool with over 500 million users worldwide.
Those half a billion users represent a tempting target for any malware creator who might craft an exploit to take advantage of the vulnerability, especially as many users seldom update the app. As such, developer RARLAB has released a new version, [1]WinRAR 6.23 , which fixes the bug.
[2]
The WinRAR flaw, which has been allocated the CVE record [3]CVE-2023-40477 , is said to be due to a lack of full validation of user-supplied data when opening an archive file that could result in a memory access beyond the end of an allocated buffer.
[4]
[5]
The flaw made it possible for an attacker to construct a RAR file to take advantage of this and use it to execute code in the context of the current process, earning the vulnerability a CVSS severity rating of 7.8 (high).
This issue was discovered by a security researcher identified as “goodbyeselene” working with Trend Micro's [6]Zero Day Initiative (ZDI) on June 8, who reported it to the vendor. The vulnerability was publicly disclosed by ZDI on August 17, but the vendor had already issued an updated version of the application containing a fix by August 2.
[7]
That updated version of the application, WinRAR 6.23, also contains fixes for several other flaws, including WinRAR starting on a wrong file if a user double-clicked an item in a specially crafted archive. Other minor changes include the immediate deletion of temporary files created when extracting or testing multiple archives.
[8]Microsoft finally gets around to supporting rar, gz and tar files in Windows
[9]Cyber-snoops broke into US military contractor, stole data, hid for months
[10]Misguided call for a 7-Zip boycott brings attention to FOSS archiving tools
[11]We regret to inform you there's an RCE vuln in old version of WinRAR. Yes, the file decompression utility
WinRAR is a shareware product, which means anyone can download and use the product for free for up to 40 days before purchasing. Licenses cost $29 for a single computer, but are perpetual, at least for the version of WinRAR you get at the time of purchase.
Microsoft announced back in May that it was [12]adding support for RAR files into Windows , along with support for other archive formats, including tar, 7-zip, gz and others, thanks to the addition of the libarchive open-source library, but presumably only for Windows 11. Redmond has had native support for zip files since the last century, when Windows 98 debuted. ®
Get our [13]Tech Resources
[1] https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZOOKJNjH2hWds0bXTWfTIgAAAYA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40477
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZOOKJNjH2hWds0bXTWfTIgAAAYA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZOOKJNjH2hWds0bXTWfTIgAAAYA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.zerodayinitiative.com/advisories/ZDI-23-1152/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZOOKJNjH2hWds0bXTWfTIgAAAYA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2023/05/24/microsoft_rar_support_native_windows/
[9] https://www.theregister.com/2022/10/05/military_contractor_hack/
[10] https://www.theregister.com/2022/06/27/7zip_compression_tool/
[11] https://www.theregister.com/2021/10/21/winrar_rce_vuln_positive_technologies/
[12] https://www.theregister.com/2023/05/24/microsoft_rar_support_native_windows/
[13] https://whitepapers.theregister.com/
Also available for Linux... if you're no CLI hater :-)
I've been using the Linux version of (Win)RAR for many years... my Reg file works for both versions though I am not sure about giveaway licences. Some may find the CLI-only Linux version a bit sparse but it has the same functions as the Windows version, just not as much eye candy.
Good Find
Good find and well handled. Good job goodbyeselene and RARLAB .
I still laugh every time I see an enterprise that rolls out winrar or winzip on a corporate level, I can only ever say "eww" or think "what silly old warez d00d admin put this out there?". Particularly when there are far better and far more open and un-encumbered license-wise solutions like 7zip that don't come with a shareware trial nag on every launch. Keep it classy y'all.
Yep. I'll be honest, I used to use WinRar before 7zip came out.
But, ever since 7zip has been available, I had been steadfast in using it and talking about it around me.
Yes, but...
Have you ever looked at the source code for 7-Zip?
It may "work", but there's no way I would want to generate the test vectors for it.
It does have some comments, but mainly commented-out code - including things like "if ( some-condition)" being comment-out to make the following block unconditional.
One of the functions is something like 1500 lines long, and includes a number of potentially-infinite nested loops.
Still, it seems to do the job if you can ignore the fact that it may have similar security vulnerabilities ;-)
Well... I use 7z for many things (it's faster and normally has better compression rates than RAR) but for everything that has to survive for a long time and is REALLY important I use RAR only. Main reason is that RAR can add user-defined amounts of redundancy to an archive, so even if bits of an archive go and bit-rot, chances are I can still access most if not all of it. I don't think 7z has such a feature.
WinRAR security hole?
But how will I install, special_craked_game.exe ?