Key takeaways:
- RARLAB has released an update for its popular WinRAR compression tool to address a high-severity security vulnerability.
- This flaw, discovered by the Zero Day Initiative team, allows hackers to execute arbitrary code when users open a RAR file.
- The security vulnerability stems from a lack of proper validation of user-supplied data within the processing of recovery volumes, enabling attackers to execute code within the current process.
RARLAB has released a crucial update aimed at addressing a high-severity security loophole within its popular WinRAR compression and archiving tool. This flaw enables threat actors to execute arbitrary code upon the launch of a RAR file, thus raising significant concerns about user data safety and system integrity.
The WinRAR vulnerability, tracked as CVE-2023-40477, was first discovered by the Zero Day Initiative (ZDI) team on June 8. The security flaw has been deemed critical with a CVSS severity rating of 7.8. It enables hackers to create a RAR file and use it to execute code in the context of the current process.
“The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process,” Zero Day Initiative explained.
Security researcher “goodbyeselene” reported the vulnerability to RARLAB in early June 2023. However, the flaw was publicly disclosed several days after the vendor released an updated version of WinRAR on August 2.
WinRAR version 6.23 contains fixes for other flaws
The latest WinRAR update (version 6.23) also brings fixes to patch several other bugs in the application. For instance, it addresses an issue that could cause WinRAR to start a wrong file after a user double-clicked an item in a specially crafted archive. Other improvements include the deletion of temporary files created when extracting or testing multiple archives.
Back in May, Microsoft announced its plans to add native support for RAR files and several other achieve formats (such as .rar, .tar, .tgs, .7z) into Windows. The company is currently testing this capability with Windows 11 Insiders on the Beta Channel. It should eliminate the need for users to install third-party tools to access these files.