Slashdot Mirror
19-Year-Old WinRAR Vulnerability Leads To Over 100 Malware Exploits (slashgear.com)
"Last month it was discovered that WinRAR, software used to open .zip archive files, has been vulnerable for the last 19 years to a bug that's easily exploited by hackers and malware distributors," writes SlashGear. Slashdot reader Iwastheone quotes their report:
Check Point, the security researchers that revealed the WinRAR bug, explain that the software is exploited by giving malicious files a RAR extension, so that when opened they can automatically extract malware programs. These programs are installed in a PC's startup folder, allowing them to start running anytime the computer is turned on, all without the user's knowledge.
Once the bug was disclosed, however, hacker groups really began using it to their advantage, with various nations becoming the target of state-backed cyber-espionage campaigns attempting to collect intelligence. The latest comes from McAfee, the software security firm, which notes that it has identified over 100 unique exploits that use the WinRAR bug, most of them targeting the U.S.
WinRar 5.70, released in late January, patches the behavior, but "it must be manually downloaded and installed from the website, leaving most users unaware of the critical update," the article warns.
It also estimates that during the last 19 years WinRar has been downloaded over 500 million times.
Once the bug was disclosed, however, hacker groups really began using it to their advantage, with various nations becoming the target of state-backed cyber-espionage campaigns attempting to collect intelligence. The latest comes from McAfee, the software security firm, which notes that it has identified over 100 unique exploits that use the WinRAR bug, most of them targeting the U.S.
WinRar 5.70, released in late January, patches the behavior, but "it must be manually downloaded and installed from the website, leaving most users unaware of the critical update," the article warns.
It also estimates that during the last 19 years WinRar has been downloaded over 500 million times.
I use 7-zip. Haven't installed WinRAR in like a decade.
WinRAR was shipping a proprietary free-as-in-beer DLL to uncompress ACE archive format files.
WinRAR uses 'magic' to detect file types so malware authors are naming archives '.rar' to get it to WinRAR which then passes it into the vulnerable DLL where it uses a path traversal exploit to install malware.
Since nobody uses ACE format files anyway the WinRAR authors dropped support and removed the DLL.
Users need to update and Windows doesn't make that easy like linux distros do.
Maybe it's just me but I find the vague and nebulous "popular" articles to be confusing and hard to read.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Comment removed based on user account deletion
Had multiple archives which were reporting as corrupt / damaged in 7zip and opened fine in WinRAR, near a decade ago.
Had I followed the advice of 7zip I could have discarded perfectly good data.
I reported the bug YEARS ago, supplied files too, nope no interest from the developers.
I spoke with someone yesterday with someone who said the same thing is STILL going on.
Nope, I don't have faith in 7zip, working with the data reliably is the #1 thing for me. I'll stick with a patched WinRAR thanks.
That's a heckuva lot of downloads.
"It also estimates that during the last 19 years WinRar has been downloaded over 500 million times."
And dozens of people have bought it.
...that there were some bugs in WinRAR when all of a sudden everybody starts getting .RAR file attachments from random people?
Why use an obscure compression program otherwise?
1. It's faster, or at least was much faster until win10 2. It had capability that the native windows did not for a long time, which was the ability to open an archive and run an exe without extracting the entire archive, and winrar would automatically extract any dependencies on demand as they were called for. That has its uses when you dont want to extract a 700mb zip file just to run one or 2 programs within. At least that was my rationale, prior to win10 which has the same capability.
Isn't it that old fashioned shareware/nagware that asks for payment?
If I had a DeLorean... I would probably only drive it from time to time.
Personally the Windows zip management doesn't impress me at all, I much prefer 7zip. Also use 7zip for the rare use of rar files, which I don't encounter often any more.
If I had a DeLorean... I would probably only drive it from time to time.
Who uses .RAR archives these days?
Well 7-Zip is open source and it's not affected.
On another note, I don't understand why anyone would use WinRAR. 7-Zip is superior in every way.
Maybe just me, but all the contexts I ever saw WinRAR in convinced me that it was always sketchy AF. In any case I don't think I've seen it in 10 years.
The real sad part of this is that the submitter, iwastheone, is creimer!
I can assure you I am not this Creimer persona. I used to use my old account "sternishefan' here on /., I've made this known before. Whatever this creimer controversy is all about, I do not care nor do I pay attention to any related comments about it. I come here for the knowledge I've learned from /. over the years.
The Windows zip support is a bit like having just neutered animals on a farm and expect them to procreate.
Anyway - this posted on Slashdot was actually pretty informative anyway since I have now updated my Winrar installation.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
Nope. You are most likely the only one.
This space unintentionally left blank.
If WinRAR were open source, this would never have happened!
In this case the problem was libace being closed source (-ish), at least they used an old unmaintained binary of libace, instead of dropping it or using a maintained open source version.
"It's ok. Just download it and unzip it and don't run it if it's .exe!"
His friend moused to the DL button. The other guy made a face like Richie's little brother waiting to see if Kirk would drink the tranya.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Pwned, yes. But don't worry, the only people who know the web sites and pages you visit are are the advertising giants of Google, Amazon, facebook. And Microsoft monitors you even if you use Chrome, and wants you eventually subscribe to Windows as a cloud thing so it can monitor you directly, and every government on the planet, shrimp salad, shrimp and potatoes, shrimp burger, shrimp sandwich. That's about it.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Why doesn't the security side of the house just blacklist the file and the world is saved? It's as simple as deleting the file. I know WinRar would love people to upgrade their software for a FEE, but the easiest solution for all is for the powers that be (Microsoft, Symantec, McAfee, etc), to quarantine the file, "UNACEV2.DLL".
MD5 Checksum: 7FE66F3BD9CBB998D56EF60D511FF06F
SHA-1 Checksum: DFD7AF26DD22DFDE03B78E835AAAA1569737A6C3
SHA-256 Checksum: 219FF84A756E7912C84EC7BE3BEE5E29FB91909AAEF8856C3DDA2C4F7723AAE7
"To users who are not interested in an upgrade or who don't find a localized version of WinRAR 5.70 yet, win.rar GmbH’s advice is to delete the UNACEV2.DLL file from their current WinRAR version to be reliably protected again. All users of WinRAR 5.10 or any newer version can find the UNACEV2.DLL file in the WinRAR program folder. WinRAR users of versions older than 5.10, can find the UNACEV2.DLL file in the Formats subfolder of the WinRAR program."
I catually thought that this was something that had been discovered earlier. I clearly remember that even in unrar.exe in Dos. Back around 1992/93'ish, I had infections as well... So getting a virus from opening a zip/rar/arj/zoo on MS-Dos-6.22 or earlier, was something we were used to.
https://otland.net/threads/goo... (SFW)
#DeleteFacebook
The problem is rar.
When all you have is a hammer, every problem starts to look like a thumb.
You said as if WinRAR has no choice of their library. Hmm... Who made the decision to use the library then? Not WinRAR? Then they can't find an alternative after knowing the bug? Yeah right.