Experts at Check Point discovered the logical bug in WinRAR by using the WinAFL
Over 500 million users worldwide use
The flaw is an “Absolute Path Traversal” issue in the library that could be exploited to execute arbitrary code by using a specially-crafted file archive.
The issue affects a third-party library, called UNACEV2.DLL that is used by WINRAR.
The flaw resides in the way an old third-party library, called UNACEV2.DLL, handles the extraction of files compressed in ACE data format. The experts pointed out that WinRAR determines the file format by analyzing its content and not the extension, this means that an attacker can change the .ace extension to .rar extension to trick the victims.
The experts discovered that an attacker leveraging the path traversal vulnerability could extract compressed files to a folder of their choice rather than the folder chosen by the user. Dropping a malicious code into Windows Startup
“We have found a vector which allows us to extract a file to the Startup folder without caring about the <user name>.
By using the following filename field in the ACE archive:
C:\C:
C:../AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\some_file.exe
It is translated to the following path by the CleanPath function:
C:../AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\some_file.exe
Because the
“Moreover, this destination folder will be ignored because the GetDevicePathLen function will return 2 for the last “C:” sequence.”
The following video PoC shows how to gain full control over a targeted system by tricking the victims into opening maliciously crafted compressed archive file using WinRAR.
The worst aspect of the story is that WinRAR development team had lost the source code of the UNACEV2.dll library in 2005. The way to approach the problem is drastic, the team
Don’t waste your time, install this new version of the software and do not open compressed archives with WINRAR that were received from unknown sources.
[adrotate banner=”9″] | [adrotate banner=”12″] |
(
[adrotate banner=”5″]
[adrotate banner=”13″]