In the News: WinRAR Users Threatened By Security Flaw

Image file at varying levels of file compression, from Wikipedia, used under CC BY-SA 3.0

According to a report by ZDNet [1], WinRAR, a popular Windows software for file compression and decompression, is at risk of a security flaw unless updated. Researchers at Check Point Software Technologies [2], a cybersecurity company, discovered a vulnerability in the .ACE file format of compressed files.

WinRAR is well known for offering its software free to download [3], and it is estimated to have a userbase of over 500 million users [4]. Researchers at Check Point have identified a flaw in the UNACEV2DLL library packaged with all versions of WinRAR. This library is involved in unpacking files in the .ACE format, and Check Point found a way to use the flaw to extract malicious files outside of the intended decompression folder.

WinRAR developers have released version 5.70 Beta 1 [5] of the software on January 28, 2019 with patches for this issue. These fixes are noted under the CVE-2018-20250, CVE-2018-20251, CVE-2018-20252, and CVE-2018-20253 identifiers.

This video from Check Point demonstrates the ability of the exploit to add programs to the startup folder of a Windows machine. Check out their technical paper on how they discovered this issue [6].

What do you think?

• Are you a user of WinRAR? Both trial and premium users should update their version of WinRAR as soon as possible.
• How do you keep updated with security flaws discovered in software that you may use?
• Do you set your software to check for security updates automatically?
• What are your thoughts on companies like Check Point that discovered this flaw?

Let us know what you think about this article and your responses to our questions in the comments below!

Disclaimer: The views and opinions expressed in this article are those of the author and do not constitute legal or financial advice.

Always do your own research to make informed decisions.

For more information, check out these articles:

WinRAR [Wikipedia]

WinRAR 5.70 Beta 1 released [WinRAR]

What is file compression? [Boston College]

Why WinRAR’s 40 Day Trial Actually Lasts Forever [Popular Mechanics]

Vulnerability CVE-2018-20250 [National Vulnerability Database]

edited by: Defne Inceoglu