WinRAR security issue

Ghot · Aug 24, 2023

WinRAR security issue more wide-reaching than thought [Update] - gHacks Tech News

A recently disclosed security issue in the archiving software WinRAR is affecting other software programs as well.

www.ghacks.net

A recently disclosed security issue in the archiving software WinRAR is affecting other software programs as well.

The developers of WinRAR released version 6.23 of the popular archiving software earlier this month. The release included a security fix that addressed a major out of bounds issue. Malicious actors can exploit the vulnerability to execute code on devices that run earlier versions of WinRAR.

Users who open specially crafted WinRAR archives on their devices may fall pray to the attack. The downloading of such a specially crafted archive and the opening of it on the user's system is sufficient to allow attackers to execute arbitrary code on the device.

The issue, which is identified as CVE-2023-40477, is a high-severity vulnerability found in the processing of recovery volumes. The update to WinRAR 6.23 addresses the vulnerability and WinRAR users should install the update as soon as possible to protect their devices against potential exploits of the vulnerability.

More...

WinRAR 0-day that uses poisoned JPG and TXT files under exploit since April

Vulnerability allows hackers to execute malicious code when targets open malicious ZIP files.

arstechnica.com

A newly discovered zero-day in the widely used WinRAR file-compression program has been exploited for four months by unknown attackers who are using it to install malware when targets open booby-trapped JPGs and other innocuous inside file archives.

The vulnerability, residing in the way WinRAR processes the ZIP file format, has been under active exploit since April in securities trading forums, researchers from security firm Group IB reported Wednesday. The attackers have been using the vulnerability to remotely execute code that installs malware from families, including DarkMe, GuLoader, and Remcos RAT.

From there, the criminals withdraw money from broker accounts. The total amount of financial losses and total number of victims infected is unknown, although Group-IB said it has tracked at least 130 individuals known to have been compromised. WinRAR developers fixed the vulnerability, tracked as CVE-2023-38831, earlier this month.