Slashdot Mirror
500 Million Users At Risk of Compromise Via Unpatched WinRAR Bug
An anonymous reader writes: A critical vulnerability has been found in the latest version of WinRAR, the popular file archiver and compressor utility for Windows, and can be exploited by remote attackers to compromise a machine on which the software is installed. "The issue is located in the 'Text and Icon' function of the 'Text to display in SFX window' module," Vulnerability Lab explained in a post on on the Full Disclosure mailing list. "Remote attackers are able to generate own compressed archives with malicious payloads to execute system specific codes for compromise."
Hideki!
Modern app appers compress apps using APPS, not Luddite software like WinRAR!
Apps!
I must admit some of these security exploits elude me a little, but I've read both of TFAs, and I guess my question is "what the heck is this SFX window and what's it for"?
Why the heck is an archiving program executing arbitrary code in the first place? That's crazy.
Lost at C:>. Found at C.
Sounds like one of those crappy open source projects. This doesn't surprise me one bit.
If you download and willingly execute an .exe you're already fucked.
So a self-extracting RAR can be rigged to exploit your machine. A self-extracting RAR is an executable. So a executable from an untrusted source can exploit your box. Wake me when you have a real vulnerability.
Oh, and samzenpus, that was the most clickbait bullshit Slashdot headline in months. You should be horsewhipped.
If it "affects only the latest version" as the article states, is it likely that 500 million people have the latest version- specifically- installed?
Can we finally admit WinRAR is terrible and annoying? Nobody cares about and extra few percent of zip style compression.
Not that compression itself is bad. But we don't need like 5 competing formats that essentially get us to the same place while causing users a bunch more clicks and forcing them to install some crappy nagware.
Contaminated while long term survival are incompatible 'Yes' to any And the striking With process and it was fun. If PI'm For a moment and to the original else up their aases
There are still people out there who use WinRAR? WHY?!
It's just an annoyance after 30 days and 7zip is better at compressing, not to mention it's actually free.
Go on, exorcise your shareware demons forever!
So... you can use WinRAR to create an executable file that executes code?
I guess I'd better get cl.exe and gcc off my systems, too.
An executable file can do anything. So you can make an executable file with WinRAR that does something nefarious. Big fucking whoop. You can make a file that looks like a self-extracting archive and does something else with any old compiler.
And they're complaining about security flaws in closed-source, for-profit software.
Well... Not to underestimate the finding, but frankly it's nothing new. Executables may carry malicious code, no matter how innocent they look.
To avoid running the executable, you can use WinRAR (or 7Zip etc) to open the SFX as if it were a regular archive.
This is a Windows-only issue. Nothing to see here, move along.
Must be for people who need to unrar the 7zip installation file
How is this a remote exploit? It seems you have to download the malicious file and run it.
millions more going hungry (mostly children), exploding, poorly attended to, marching in the streets for change,,, we imaginary semi-chosens get... even more fake bad news?
WinRAR totally sucks, why would 1/14 of the entire planet's population (not counting the billions of little brown kids without a computer) be using this software?
... from before the 90's?
that is our fault ? they should use condoms. no irony whatsoever. condoms work against hunger.
7Zip is better in many ways. Lightweight is the one major thing it has on WinRAR.
Some would claim that it isn't even the most major thing. The .7z format is documented, like the .zip format and notably unlike the .rar format, which all about about a dozen people are legally prohibited from understanding because of the UnRAR license.
You would install WinRAR because someone requires you to submit an archive in RAR format and nothing but WinRAR (or command-line products from the same company) can create archives in RAR format. But in practice, I don't expect this to come up very often outside the warez scene, whose release standards have traditionally required split RAR.
What "scene"? Do you mean the warez scene? I thought it was still using RAR files split into several dozen pieces.
since 7-Zip was introduced? Funny.
Using a self extracting winRAR file as a vector to run code on Windows - is a vulnerability is Windows.
'Execution of poc.pl aborted due to compilation errors.'
See samzenpus, it's not difficult to think up an accurate title :)
See subject: This is 1 time I'm GLAD I didn't upgrade! I.E.-> From the vulnerability report here http://seclists.org/fulldisclo... it appears that earlier models are NOT AFFECTED by this...
See, I personally consider to be the BEST archiver overall for years now - I haven't HAD a GOOD SOLID REASON to try others as I have license to it.
E.G.-> I used to consider WinZip that since it has a "perfect fit" for "Form fits function" in its GUI design (both do really for what they do).
However - WinRAR almost consistently does better in memory usage from tests I've seen & done myself, compressing the SAME datasets into it of many kinds, + WinRAR does more formats "natively" (minus having to "shell out" to an external program to do compression for a particular format).
WinRAR "took me away" from WinZip about, oh... 11 yrs. ago or more.
Any of you guys?
FEEL FREE to "Turn me on" to OTHER archivers & their value vs. what I just said, OR point me to tests that would "turn me away" from what I consider one of the BEST programs there is in the shareware/freeware realm.
APK
P.S.=> For once, an update would've turned into a "downdate" for me from this ware
See subject & -> http://it.slashdot.org/comment...
* :)
(I'll take every bit I can in terms of that "few extra %" of compressability personally).
APK
P.S.=> I like WinRAR (5.20 user here, which is a safe model per the vulnerability report which only affects this NEWER one - so, I am GLAD I didn't upgrade for once) & consider it to be one of the FINEST sharewares ever constructed as well as one of the MOST useful almost daily... apk
See subject: This place USED to a lot cooler, circa say, 2005 when I first came around to about, oh... 2008 or so imo.
That's about when the "frist post/frosty" came around, the "mooo cow" (sexconker suprises me here, yes, from what I've seen it's him doing it when he forgot to submit ac doing those) we have now.
Then the "impersonating me" started, & of ALL people (which surprised me quite a bit since I liked a lot of his posts which informed me more on things political/international etc. - et al) Jeremiah Cornelius (former MS employee & now VMWare employee) was the one doing it.
So, trust me - you're NOT the only one putting up with it man...
Then came the freaks that nigh CONSTANTLY hassle, troll, & downmod all of my posts (which I just get around easily reposting, yes, unlimitedly as ac even here)!
See - I remember when we used to actually rationally DISCUSS the various merits/demerits of topics on computing - you gained a lot more insights or points-of-view + know-how then... since nobody "knows it all" in this field, or life.
Now? Well, you know - you said it better than I have, lol, love how you did actually!
(Plus, I don't think you & I have ever had a problem so, there you are...)
APK
P.S.=> Don't feel too bad man since like I said above - I get THAT kind of crap here nearly EVERY single day & every time I post...
However? Man - I LOVE SMASHING THEM INTO THE GROUND WITH FACTS vs. THEIR TROLLING CRAP!
(I know - sounds pretty bad, but after a while? You have to strike back OR sit there & get abused constantly instead - take your pick, ymmv!)... apk
You believe in the concept of a "real" name... How quaint. Sure there is such a thing as a legal name that you use on legal forms, and a lot of times people think that is your "real" name. But how real is it? Is it what your friends, family, acquaintances or coworkers call you? Probably not. I just put hackwrench into Bing and my slashdot page is on the first page of listings. My blog is in the first page of results in Google. That real enough for you?
If you are still using Windows global spyware...
http://portableapps.com/apps/utilities/peazip_portable
or...
http://www.peazip.org/peazip-portable.html
In Linux/BSD this isn't an issue. It just works.
And require a crack to get working properly? Why would anyone still use that crap. As everyone else has said, 7-zip has I thought, been standard for like 5 years, which is eternity in internet time... Do the slashdot editors still use winrar or something because they are stuck in the glory days of yore?
That, or they really are out of tune with the windows software scene.
-
But they're not very tasty.
"So long and thanks for all the fish."
They only find out this now? OMG...
Now is a great time to upgrade to ZIPmagic: www.zipmagic.co/features.html We give away our file compression for 100% free. Yet the product is professionally, fully supported because our core business is disk compression, which is paid. Take a look at the features list I've linked above, and let me know if, even leaving the WinRAR exploit aside, you can think of a reason to not switch? In addition to being 100% free and 100% supported, ZIPmagic completely outclasses traditional archivers such as WinZip and WinRAR. You get tools that WinZip charges $60+ for free with ZIPmagic. And the disk compression angle is one you will not find in any competing archiver at all. It just does not exist on Windows outside of ZIPmagic. Last but not least, I'd be very surprised if a vulnerability of this sort was ever uncovered in ZIPmagic. ZIPmagic's file compression is plug-in extensible and currently has two plug-ins, one based on the excellent open source 7-Zip stack, and the other based on the WinZip proprietary ZIPX format for JPEG compression which even 7-Zip cannot do. ZIPmagic also integrates with Windows Explorer, mounting all archives as regular folders like Windows's ZIPfolders, but does it for all archive types (even RAR, 7-Zip, and ZIPX) - in addition to featuring completely stand-alone archive management applications.
I have yet to find a newer copy of Winrar that is not packaged with malware.
Dowloaded from http://www.rarlab.com/ as of 10 minutes of this post.
File - WinRAR x64 (64 bit) 5.21
They keep updating their code every so many days to try to avoid detection. Once the AV guys catch up the malware list repopulates with bad stuff again from their program.
Most recent scan results:
Zillya!
Backdoor.DarkKomet.Win32.27531
Premise, I no longer use WinRar as I switched mine and my friends' machines to open source alternatives like 7-Zip and PeaZip years ago.
I wonder why the titles (here and on other website) about n millions of Winrar *users* at risk: if I correctly understood the vulnerability description WinRar is not the target of a possible malicious use of the exploit, it is the vector that can be used to build an infected self extracting (exe) archive containing hidden commands where text and icon data should be, so the real risk is for anyone (not just WinRar users) as now there is an easy & handy tool (Winrar, until patched) that can be used to pack forged self extracting archives.
... closed source software is harder to inspect, design and coding flaws are more likely to pass undetected and stay for years. Err on the safe side and use Open Source replacements like 7-Zip, j7zip, p7zip, PeaZip...