19-year-old vulnerability in WinRAR finally fixed

Flaw affecting 500 million users could enable hackers to execute remote code

Security flaw

Security researchers have discovered a bug in the WinRAR file compression application that can allow hackers to execute code remotely. The flaw has existed in all versions of the software for the last 19 years.

According to a blog post by researchers at Check Point Software, the exploit works by just extracting an archive, and puts over 500 million users at risk.

"We found a logical bug using the WinAFL fuzzer and exploited it in WinRAR to gain full control over a victim's computer," said Nadav Grossman of Check Point Software.

"The exploit works by just extracting an archive and puts over 500 million users at risk. This vulnerability has existed for over 19 years(!) and forced WinRAR to completely drop support for the vulnerable format."

The flaw exists in the UNACEV2.DLL library included with all WinRAR versions. This library is used for parsing ACE (a data compression archive file format) archives.

Researchers found a path-traversal flaw that enables hackers to extract executable files into a computer's startup folder. This means that programs would run automatically whenever a system is booted up. All an attacker has to do is make a victim open a malicious archive file using WinRAR.

In response, WinRAR has dropped UNACEV2.dll from their package to fix the problem and has released WINRar version 5.70 beta 1 that doesn't support the ACE format. vWinRAR said that UNACEV2.DLL had not been updated since 2005 and it no longer has access to its source code.

The flaw is tracked under the CVE-2018-20250, CVE-2018-20251, CVE-2018-20252, and CVE-2018-20253 identifiers.

Windows users are advised to install the latest version of WinRAR as soon as possible and avoid opening files received from unknown sources.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

How LogPoint uses MITRE ATT&CK
Whitepaper

How LogPoint uses MITRE ATT&CK

15 Jan 2021
Weekly threat roundup: Microsoft Defender, Adobe, Mimecast
vulnerability

Weekly threat roundup: Microsoft Defender, Adobe, Mimecast

14 Jan 2021
Mimecast admits hackers accessed users’ Microsoft accounts
Security

Mimecast admits hackers accessed users’ Microsoft accounts

13 Jan 2021
What is public key infrastructure (PKI)?
Security

What is public key infrastructure (PKI)?

12 Jan 2021

Most Popular

IT retailer faces €10.4m GDPR fine for employee surveillance
General Data Protection Regulation (GDPR)

IT retailer faces €10.4m GDPR fine for employee surveillance

18 Jan 2021
Citrix buys Slack competitor Wrike in record $2.25bn deal
collaboration

Citrix buys Slack competitor Wrike in record $2.25bn deal

19 Jan 2021
Should IT departments call time on WhatsApp?
communications

Should IT departments call time on WhatsApp?

15 Jan 2021