One has been revealed serious security flaw in the well-known archiving program known as WinRAR which could potentially be exploited by an attacker to achieve remote execution of malicious code on Windows systems.
WinRAR a friend, not so friend
Identified as CVE-2023-40477 (CVSS score: 7.8), the vulnerability has been described as a case of improper validation while processing recovery volumes.
“The problem stems from a lack of proper validation of user-supplied data, which can result in memory being accessed past the end of an allocated buffer“, has declared the Zero Day Initiative (ZDI) in a notice, adding that “an attacker could exploit this vulnerability to execute code in the context of the current process”alluding to the fact that a system can be punctured exactly as these things are imagined in the collective imagination.
Successful exploitation of the flaw requires user interaction, as it is necessary to trick the target into visiting a malicious page or simply opening a trap archive file.
A security researcher, known by the pseudonym goodbyeselene, was credited for discovering and reporting the flaw on June 8, 2023. The issue was fixed in WinRAR version 6.23, released on August 2, 2023.
“Fixed a security issue related to an out-of-bounds write in the RAR4 recovery volume processing code“said the developers of the software.
The latest version also addresses a second problem where “WinRAR could start a bad file after a user double-clicked an item in a specially created archive“. Group-IB researcher, Andrey Polovinkin, was credited with reporting the issue.
Users are advised to update to the latest version to stop potential threats in the bud.
But WinRAR is not new to these problems
In 2019, in fact, the best known “compressor” in the world found itself correcting an old problem 19 years old; while on the one hand the fact that WinRAR Not is open source can be an advantage (less attackable “directly”, at least in theory), on the other it is more difficult to understand what problems it may have because not everyone can “get their hands on it”.
7Zip against, for example, being open source it can be accessible for better or for worse to anyone eskills permitting, problems can be fixed directly by the community.
The Open Source discourse, however, deserves an article of its own.
Are there alternatives?
Yes, many, between 7Zip, Peazip and many other clients, the alternatives to WinRAR are wasted, often they are also open source, free and do not require the purchase of any license; therefore if you don’t need something highly professional, know that there are several alternatives to WinRAR.
#WinRAR #security #hole #lurking