WinRAR patched 19-year-old bug that left millions vulnerable

WinRAR gets back at us all for hitting “next time” when prompted to pay.

Remember that software from the early 2000s that extracted .zip files and almost any other file archive on Windows PC, WinRAR? The one who bugged you constantly to buy it, but could be duped by clicking “next time?”

If you’re one of the 500 million people who’ve been using WinRAR over the years, you’ve been played. Checkpoint Research researchers have uncovered a 19-year – old bug that has created a security breach on your hard drive.

In a detailed blog post, Check Point explained that hackers can manipulate WinRAR to extract a malicious program to the startup folder of a computer by renaming an ACE file with an RAR extension. When your computer starts, the program will then run automatically.

Check Point says the flaw was there for 19-years. WinRAR quickly patched the vulnerability in response to the blog post, releasing version 5.70 beta 1, in which it dropped support for ACE archives. It turns out that the company used a third-party tool to unpack ACE archives anyway, and since 2005 it has not been updated.

No attacks were reported using this bug. But 19 years is a long time to have such a flaw, and with 500 million users potentially exposed, we would say that this is a major oversight on the part of WinRAR.

If you still use WinRAR, this would be a good time to update the software. The lesson for us all is that what you did 20 years ago on your PC can indeed haunt you.

Leave a Reply

Your email address will not be published. Required fields are marked *