WinRAR patched 19-year-old bug that left millions vulnerable

WinRAR patched 19-year-old bug that left millions vulnerable

WinRAR patched 19-year-old bug that left millions vulnerable

The popular file archiving tool WinRAR has had a bug for at least 14 years that can be exploited to take over your PC.

Discovered by, Check Point, a software company based in Tel Aviv, Israel, the flaw in WinRAR was discovered during a fuzz test which is usually used to induce software crashes by feeding random data.

"The exploit works by just extracting an archive, and puts over 500 million users at risk", the company said in a detailed report published on Wednesday.

The vulnerability itself lies in unacev2.dll, a library used to parse ACE archives, a little-used compression format that dates back to the 1990s.

It's all because of a third-party library called UNACEV2.DLL that's used to extract files compressed using the ACE compression format.

Giant tortoise feared extinct for over 100 years found on Galapagos Islands
The expedition's leader said genetic studies will be conducted to "reconfirm" the reptile is a Fernandina Giant Tortoise. After his death, his body was stuffed and is now displayed at the Charles Darwin Research Center in the Galapagos.

They created a malicious ACE archive disguised as a RAR file that, when decompressed by WinRAR, extracts a malicious executable to one of the system's Startup Folders, meaning that the malware will be executed every time the system is (re) booted. The CheckPoint researchers found that while WinRAR by default does not have access to the Windows startup folder, (C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp), a second directory, at (C:\Users\ user name \AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup) was accessible.

The developer of WinRAR has made a decision to patch the vulnerability by dropping support for the ACE format. Check Point has uploaded a video demonstrating the threat.

The creators of the WinRAR utility were notified of the vulnerability and have made a decision to fix it by dropping ACE archive format support altogether.

It's important to note that simply visiting WinRAR's website and clicking the download button is not sufficient to resolve this issue; doing so will give you version 5.61. But it's possible others may have stumbled on the bug as well.

Recommended News

  • Billionaire Branson hopes aid concert opens Venezuela's borders

    Billionaire Branson hopes aid concert opens Venezuela's borders

    Vice President Delcy Rodriguez has alleged the aid is poisonous and could lead to cancer. In televised comments on Thursday, Maduro said the stockpiling was a "provocation".
    Trump Calls Jussie Smollett Attack 'Horrible'

    Trump Calls Jussie Smollett Attack 'Horrible'

    According to the website, Jussie will reference MAGA (Make America Great Again), homophobia and racism during the gig. Many celebrities have shown their support for Jussie following the attack, including his Empire costars Taraji P.
    Hikes EPF interest rates to 8.65%

    Hikes EPF interest rates to 8.65%

    Retirement fund body EPFO on Thursday increased the interest rate on PF deposits to 8.65 per cent for the 2018-19 fiscal year. EPFO has an active subscriber base of more than 60 million and manages retirement savings of over Rs 11 lakh crore.
  • Lewis Hamilton braced for big Ferrari challenge

    Lewis Hamilton braced for big Ferrari challenge

    He also survived a 360-degree spin in the middle of the track en route to finishing 132 laps and recording the fourth-best time. The main rule change this season is a redesign of the car's front wings, which F1 hopes will allow for more overtaking.
    Inside The Mark Hotel, New York, where Meghan Markle celebrated her babymoon

    Inside The Mark Hotel, New York, where Meghan Markle celebrated her babymoon

    The couple, who could not attend the ceremony in London, accepted the award for best worldwide group via video message. Meghan is set to visit Morocco with her husband, Prince Harry for a royal tour starting on the 23rd.
    'The Twilight Zone' Trailer: Revival From Jordan Peele

    'The Twilight Zone' Trailer: Revival From Jordan Peele

    The CBS All Access series will be a modern reimagining of the original, which premiered in 1959 and continued through 1964. Jordan Peele is taking us from the sunken place of Get Out to the twisted and wild worlds of The Twilight Zone .
  • Tony Romo To Play In 2019 AT&T Byron Nelson Golf Tournament

    Tony Romo To Play In 2019 AT&T Byron Nelson Golf Tournament

    Tony Romo is a legendary competitor, a member of Trinity Forest, and long-time friend of AT&T and the Salesmanship Club of Dallas. Romo played his first PGA Tour event at the Corales Puntacana Resort and Club Championship in March 2018, where he finished last.
    Chelsea win against Malmö gives Maurizio Sarri some breathing space

    Chelsea win against Malmö gives Maurizio Sarri some breathing space

    These players are playing for a start in a cup final at Wembley on Sunday, yet nobody looks as though they can be bothered to play for the manager.
    Fan costs Georgia the game by throwing stuffed animal onto court

    Fan costs Georgia the game by throwing stuffed animal onto court

    Weatherspoon successfully made that attempt before missing the third, giving his team the win. "We were blessed and fortunate". Georgia was hoping to win its second conference game but instead drops to 1-12 in SEC play and 10-16 overall this season.
  • Salman Khan replaces Atif Aslam song from his film Notebook; Here's Why

    Salman Khan replaces Atif Aslam song from his film Notebook; Here's Why

    What is the future of the song? At this point of time, the issue in front of the Nation is bigger and it should be solved. I know any artiste or common individual is not responsible for what has happened, but the government is.
    Jim Boeheim Hit, Killed Man With Car After Last Night’s Syracuse Game

    Jim Boeheim Hit, Killed Man With Car After Last Night’s Syracuse Game

    Boeheim has been the head coach at Syracuse for 42 years, making his debut with the team all the way back in 1976. He has taken the Orange to the NCAA tournament 32 times, including five trips to the Final Four, the site says.
    'Haunting of Hill House' Renewed for Season 2 by Netflix

    'Haunting of Hill House' Renewed for Season 2 by Netflix

    That means you'll have to get your Crain fix purely from season 1, as their story has officially come to a close.at least for now. The second season will tell an entirely new story and feature all new characters separate from those in the first season.

We are pleased to provide this opportunity to share information, experiences and observations about what's in the news.
Some of the comments may be reprinted elsewhere in the site or in the newspaper.
Thank you for taking the time to offer your thoughts.