500 Million Users At Risk of Compromise Via Unpatched WinRAR Bug 129
An anonymous reader writes: A critical vulnerability has been found in the latest version of WinRAR, the popular file archiver and compressor utility for Windows, and can be exploited by remote attackers to compromise a machine on which the software is installed. "The issue is located in the 'Text and Icon' function of the 'Text to display in SFX window' module," Vulnerability Lab explained in a post on on the Full Disclosure mailing list. "Remote attackers are able to generate own compressed archives with malicious payloads to execute system specific codes for compromise."
Huh? (Score:2, Interesting)
I must admit some of these security exploits elude me a little, but I've read both of TFAs, and I guess my question is "what the heck is this SFX window and what's it for"?
Why the heck is an archiving program executing arbitrary code in the first place? That's crazy.
Re:Huh? (Score:5, Funny)
No way, opening links and viewing youtube videos is how you get exploited in the first place ... and it's sinful and could lead to dancing.
Re: (Score:3)
Re: (Score:3)
Re: (Score:2)
SFX refers to the self-extractor piece.
It lets you compress a bunch o' shit, then package it as an executable file.
The executable contains the compressed shit, the decompression algorithm, and a short script about where to unpack shit to, what to title the SFX window, etc.
Run the executable and your 8 MB download turns into a 25 MB folder with shit in it.
People distribute self-extractors because you don't need to rely on them having WinRAR installed, don't need to rely on them knowing where to put the files
Re: (Score:2)
Wondering how you whiny little punks all survived to adulthood while believing people give a crap about your opinions.
BS (Score:1)
If you download and willingly execute an .exe you're already fucked.
Click-bait BS (Score:5, Insightful)
So a self-extracting RAR can be rigged to exploit your machine. A self-extracting RAR is an executable. So a executable from an untrusted source can exploit your box. Wake me when you have a real vulnerability.
Oh, and samzenpus, that was the most clickbait bullshit Slashdot headline in months. You should be horsewhipped.
Re: (Score:3)
Oh, I don't know ... it's a real vulnerability, dated Monday, and rated as a 9 (I assume out of 10) ... in terms of being an actual thing and showing up in a timely manner, I'm not sure I'd call it clickbait.
Now, anything Nerval's Lobster posts which links to Dice? That I'd call clickbait.
Re: (Score:2)
it was a so real vulnerability that the winRAR author set it into a WONTFIX. And he's right.
Re: (Score:1)
So can WinRAR - you just extract the archive instead of running the executable.
See http://www.rarlab.com/vuln_sfx... [rarlab.com]
Re: (Score:1)
You could already do that. Injecting malicious code into a legitimate executable is a well known tactic. This is literally "executable runs executable code" GASP!
Re: "Real" Names (Score:1)
Re:Click-bait BS (Score:5, Insightful)
Actually, the problem is NOT the executable. The SFX part is NOT compromised at all. It's completely legitimate standard WinRAR SFX.
However, the bug is that there's a buffer overflow in the SFX program - you can give it a malicious HTML file that cause it to execute code.
The deal is that all a malicious user has to do is inject their file into a RAR archive and set a flag to have the SFX program show it as part of the SFX process. The SFX stub will check clean by all anti-virus because it's the same SFX stub as what WinRAR ships with.
It's entirely possible that you cannot detect this - if the archive is password protected, for example, so you can't detect the bad HTML file at all. And the SFX will still check clean, but really infect your PC.
The only workaround is to use WinRAR itself to open the SFX
Re: (Score:2)
+1 First person to actually RTFA
Re: (Score:1)
So what you are saying is that an EXE file can execute code?
Re: (Score:2)
I always tack on a .rar to any SFX so I could disable auto extract. I'm still using 3.93.
Re: (Score:2)
It sounds like the system will be protected if you're running as standard user instead of admin since it won't be able to elevate. Correct?
Re: (Score:1)
Re: (Score:2)
I was surprised to learn that Winrar had that many users, considering it's a paid application. I'm one of those weirdos who did pay for it (they gave me a special for $15) even though I do indeed pirate a lot of stuff.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
> It's free for personal use
[citation needed]
Re: (Score:2)
Relax man. You don't have to pretend to pirate "lots of stuff" just to fit in here. I almost always buy things that I like and find useful.
Re: (Score:3)
I don't even bother with 7z format because modern OSs support ZIP out of the box. I only install 7-zip for slightly better interface than the one built in to the OS, but I know that anyone I send the file to can read the file.
Re: (Score:2)
I have 7zip installed because it can extract RAR files and it isn't WinRAR.
Re: (Score:1)
As I recall. HTH
Re: (Score:2)
I've seen issues across several production environments where several .zip tools would miss files in very large archive sets, moving to .7z fixed these issues.
Sharewarez demons (Score:2)
What "scene"? Do you mean the warez scene? I thought it was still using RAR files split into several dozen pieces [wikipedia.org].
... what? (Score:2)
So... you can use WinRAR to create an executable file that executes code?
I guess I'd better get cl.exe and gcc off my systems, too.
Re: (Score:1)
> implying that there's code for BeOS
I think you're probably safe with that.
TIL: People still use WinRAR instead of 7zip... (Score:1)
And they're complaining about security flaws in closed-source, for-profit software.
Nothing new here (Score:1)
Well... Not to underestimate the finding, but frankly it's nothing new. Executables may carry malicious code, no matter how innocent they look.
To avoid running the executable, you can use WinRAR (or 7Zip etc) to open the SFX as if it were a regular archive.
remote? (Score:1)
Re: (Score:2)
"remote" as in, unlikely to affect users smart enough to avoid running untrusted binaries.
Re: (Score:1)
But they're not very tasty.
Critical vulnerability found in WinRAR? (Score:2)
'Execution of poc.pl aborted due to compilation errors.'
500 million users at risk via unpatched Window bug (Score:2)
Didn't winrar have a nag screen? (Score:2)
And require a crack to get working properly? Why would anyone still use that crap. As everyone else has said, 7-zip has I thought, been standard for like 5 years, which is eternity in internet time... Do the slashdot editors still use winrar or something because they are stuck in the glory days of yore?
That, or they really are out of tune with the windows software scene.
Re:WinRAR (Score:5, Informative)
On the contrary; WinRAR sucks because it isn't open source. Instead, it's proprietary, spammy nag-ware.
7Zip, the actual open source competitor to WinRAR, is much better.
Re: (Score:2)
I have both 7zip and winrar installed, and I gotta say I much prefer using winrar over 7zip. The UI is just a lot more elegant and intuitive, and the shell integration works better.
Re: (Score:1)
I also have both and like WinRAR more.
Open WinRAR
go to Help/About WinRAR...
click on the books
This is why it's better.
Re: (Score:2)
7zip isn't intuitive? How dumb do you have to be to type something like that.
Surprisingly less dumb than somebody who responds to a remark that wasn't actually made.
Re: (Score:2)
"The UI is just a lot more elegant and intuitive" implies that 7zip's interface is not intuitive as compared to WinRAR."
Yes, that is the statement the OP made. You responded as if he had said:
7zip is unintuitive.
Which is a statement he did not make.
Congratulations on winning the dumbass award.
Mmm Hm.
Re: (Score:2)
It's hard to take you seriously when all one has to do is scroll up.
Re: (Score:1)
Re: (Score:2)
Yea, it's designed as standard behaviour. There's a post extraction utility that'll run any valid script. But who in their right minds runs somefile.exe on their 'computer'. Oh, wait, no need to answer that one.
Re: (Score:2)
Same here. I get blasted by people regularly for using WinRAR instead of 7-Zip, but I prefer it for the exact same reason you do. It's just more convenient to use. Hell, I even paid for it.
However, to avoid warring about it and for the sake of ease of file exchange, I only create ZIP files. For the same reason, I am thoroughly annoyed by people using the 7-Zip format for archives. The few extra bytes saved is not worth the annoyance, neither for RAR nor 7z files.
Re: (Score:2)
I am thoroughly annoyed by people using the 7-Zip format for archives. The few extra bytes saved is not worth the annoyance, neither for RAR nor 7z files.
What annoyance?
Re: (Score:1)
7z has better compression, is typically faster, multi-platform, and FREE. Why people use winrar over 7z, I can't understand.
Re: (Score:2)
I have both 7zip and winrar installed, and I gotta say I much prefer using winrar over 7zip. The UI is just a lot more elegant and intuitive, and the shell integration works better.
Me too. Winrar's interface is just better for me. It has tons of options for fine-tuning or customizing your work flow. I don't like change and they haven't really changed the interface much in a very long time. If it isn't broke, don't fix it.
The RAR file format itself seems to have more features, probably because the guy makes money off his software and can afford to devote more time to responding to customer suggestions and requests. Winrar is paying the bills, Mr. Roshal and his brother are high
Re: (Score:3)
On the contrary; WinRAR sucks because it isn't open source
That's a bold statement because it goes either way. There are open source products that are better just because they are free and some are better because they simply are better. There are commercial products out there that outweigh open source products just because they have large teams with the right expertise and money to keep it going forward.
7Zip, the actual open source competitor to WinRAR, is much better
7Zip is better in many ways. Lightweight is the one major thing it has on WinRAR.
7Zip would have the same issues if it offered a self extracting option.
Re: (Score:1)
7Zip would have the same issues if it offered a self extracting option.
7zip has self-extracting support.
Re: (Score:2)
Re: (Score:2)
That's a bold statement because it goes either way. There are open source products that are better just because they are free and some are better because they simply are better. There are commercial products out there that outweigh open source products just because they have large teams with the right expertise and money to keep it going forward.
This is not really one of those cases though, archiving has become a commodity and the only reasons WinRAR has a huge following is that it is old (1995) from before Windows XP came with built-in ZIP support , it became the de facto archive format on Usenet and there's no open specification so competing tools can't create RAR files. It does absolutely nothing special that other tools don't do.
Re: (Score:2)
Agreed, but his statement was broad and assuming open source automatically equals better which we both know is not true. In this case it may be but lets not make it a rule of thumb.
Legally prohibited from understanding RAR (Score:2)
7Zip is better in many ways. Lightweight is the one major thing it has on WinRAR.
Some would claim that it isn't even the most major thing. The .7z format is documented, like the .zip format and notably unlike the .rar format, which all about about a dozen people are legally prohibited from understanding because of the UnRAR license.
Re: (Score:2)
Thanks to those who corrected me on the self extracting feature. I didn't know it was available.
Re: (Score:1)
Re: (Score:1)
In terms of features, WinRAR is far better (most notable with customizable fault tolerance / recovery options, PAR files, the SFX module, etc.).
In terms of compression performance, they're neck and neck. This has been true since the RAR5 format was released. A recent update to 7-Zip allowed for the opening of RAR5 archives, if you for some reason really hate WinRAR.
In terms of freeness, 7-Zip is better if you care. 7-Zip is open source and costs nothing, while WinRAR is closed source and costs nothing fo
Re: (Score:2)
if you for some reason really hate WinRAR.
Or if you just don't feel like having a ton of programs installed just for proprietary formats. I haven't run into anything that 7-zip couldn't open, so why would I bother installing anything else?
Making a scene release requires RAR (Score:2)
You would install WinRAR because someone requires you to submit an archive in RAR format and nothing but WinRAR (or command-line products from the same company) can create archives in RAR format. But in practice, I don't expect this to come up very often outside the warez scene, whose release standards have traditionally required split RAR.
Re: (Score:2)
Re: (Score:1)
You know maybe it's about time the 'scene' updates their fucking standards.
Re: (Score:2)
Maybe the "scene" should join the 21st century. As archaic as their rules are, you'd think they're running Win9x on P233's and installing WS_FTP, PKUNZIP and Trumpet WINSOCK on them.
Maybe it's a russian pirate thing... RAR's programmer is Russian. So maybe all those Eastern European/Russian pirates in the warez scene are simply favoring "one of their own" rather than use the "generic industry standards" like tarballs and zip archives favored in the West.
Also when I first heard of RAR, using it instead of Z
Re: (Score:1)
Up until August of 2015, 7-Zip could not open RAR5 archives (which were introduced introduced in August of 2013).
So while YOU may have not run into anything that 7-Zip couldn't open, there were 2 years where 7-Zip couldn't open newer RAR archives.
Re: (Score:2)
Re: (Score:3)
Came here to say this.
If you make .rar files, you're part of the problem.
Re: (Score:1)