WinRAR CVE-2023-40477

Topic

New Reply

https://www.zerodayinitiative.com/advisories/ZDI-23-1152/

This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.

ADDITIONAL DETAILS

RARLAB has issued an update to correct this vulnerability. More details can be found at:
https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa

DISCLOSURE TIMELINE

2023-06-08 – Vulnerability reported to vendor
2023-08-17 – Coordinated public release of advisory

1 user thanked author for this post.

Fred

Reply | Quote

Replies

Alex5723 wrote:

ADDITIONAL DETAILS

RARLAB has issued an update to correct this vulnerability. More details can be found at:
https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa

DISCLOSURE TIMELINE

2023-06-08 – Vulnerability reported to vendor
2023-08-17 – Coordinated public release of advisory

Thank you!
What I cannot figure out is: are winrar compressed files (*.rar) with a password protection still good?
A time ago there was said that 7zip with password protection were considered ‘much’ safer….. Anyone has knowledge of this please?

* _ ... _ *

Reply | Quote

FYI,

BleepingComputer – WinRAR zero-day exploited since April to hack trading accounts

“A WinRar zero-day vulnerability tracked as CVE-2023-38831 was actively exploited to install malware when clicking on harmless files in an archive, allowing the hackers to breach online cryptocurrency trading accounts.”

“The zero-day was fixed in WinRAR version 6.23, released on August 2, 2023, which also resolves several other security issues,  including CVE-2023-40477 a flaw that can trigger command execution upon opening a specially crafted RAR file.”

“Users of WinRAR are urged to upgrade to the latest version, version 6.23 at the time of this writing, as soon as possible to eliminate the risk of file spoofing and other recently-disclosed attacks.”

HTH.

Reply | Quote

FYI,

 

NakedSecurityBySophos – Using WinRAR? Be sure to patch against these code execution bugs…

“What to do?

————–
If you’re a WinRAR user, make sure you’re on the latest version, which is 6.23 at the time of writing [2023-08-23T16:30Z]

Apparently, there’s no automatic update system in the WinRAR software, so you need to download the new installer and run it yourself to replace an old version.”

 

HTH.

Reply | Quote

vnffrmpn wrote:

when clicking on harmless files in an archive

This is just not true!
A user must click on malicious files supplied by a hacker.

Fred wrote:

are winrar compressed files (*.rar) with a password protection still good?

This vulnerability does not affect existing rar files, password protected or otherwise.

cheers, Paul

1 user thanked author for this post.

Fred

Reply | Quote

Paul T wrote:

This vulnerability does not affect existing rar files, password protected or otherwise.

Thank you, this saves a Lot of time and coffee .

* _ ... _ *

Reply | Quote

Government-backed actors exploiting WinRAR vulnerability

In recent weeks, Google’s Threat Analysis Group’s (TAG) has observed multiple government-backed hacking groups exploiting the known vulnerability, CVE-2023-38831, in WinRAR, which is a popular file archiver tool for Windows. Cybercrime groups began exploiting the vulnerability in early 2023, when the bug was still unknown to defenders. A patch is now available, but many users still seem to be vulnerable. TAG has observed government-backed actors from a number of countries exploiting the WinRAR vulnerability as part of their operations.

To ensure protection, we urge organizations and users to keep software fully up-to-date and to install security updates as soon as they become available. After a vulnerability has been patched, malicious actors will continue to rely on n-days and use slow patching rates to their advantage. We also recommend use of Google’s Safe Browsing and Gmail, which block files containing the exploit…

Reply | Quote

FYI

Ghacks – Old WinRAR vulnerability is exploited by government-backed actors

HTH.

1 user thanked author for this post.

Alex5723

Reply | Quote