The popular windows file archival tool WinRAR has been in use for over two decades now. The software is used to view, create, pack and unpack archives in both ZIP and RAR formats. A recent report by The Register has revealed that the tool has a bug that has remained undetected since 2005.
This vulnerability in the compression tool can be used by attackers to install malware within a victim’s system and gain complete control.
Discovered by, Check Point, a software company based in Tel Aviv, Israel, the flaw in WinRAR was discovered during a fuzz test which is usually used to induce software crashes by feeding random data.
Caused by an old DLL (Dynamic Link Library) that was used to process files that were compressed in ACE format, the exploit has put over 500 million users around the world at risk today. The bug allows attackers to extract executable files into a computer’s startup folder. This means that programs would automatically run during every bootup.
The severity of this vulnerability is further increased by the fact that any malicious ACE archive can be renamed into another RAR compression format without losing the exploit.
The creators of the popular file compression tool have patched this vulnerability by stopping support for the ACE format. Users of the tool will now have to update to the latest version (5.70 beta 1), which was released last month, to safeguard their devices from this major security flaw. The company has uploaded a video as well that shows this vulnerability in action.
Also Read: Your Password Manager Has A Severe Flaw — But You Should Still Use One
