Winrar threat

AndyPix

May be a good idea to uninstall WinRar if you have it installed ..


https://arstechnica.com/information-technology/2019/02/nasty-code-execution-bug-in-winrar-threatened-millions-of-users-for-14-years/


It doesnt do anything 7-zip cant do anyway

arciere

Good to know, but unfortunately no software is 100% safe.

https://www.cisecurity.org/advisory/a-vulnerability-in-7-zip-could-allow-for-arbitrary-code-execution_2018-049/

AndyPix

Good grief

unforeseen

It says it all when the people who discovered it struggled to find a way to actually exploit the flaw.

Neil_Jones

But this isn't a WinRAR issue. It's a third party library issue. Which is dealt by WinRar.

The compression library in question, ACE, is long out of favour and everybody uses ZIP files now.

TL;DR - update WinRar, problem is solved.

techquest

I have been using WinZip, 7Zip and WinRar for years and never had a problem, it's interesting reading though. As arciere states nothing these days is 100% flawless. We should always be on our guard but sadly If someone is hell bent on finding a way in then they will.

spenderdave

When did you last see a .ACE archive? Yes, you can update. Simpler is just to delete the UNACEV2.DLL file which does exactly the same thing if you are worried. Although this mentions WinRar the same exploit will work with any zip archive program which can open .ACE, there are quite a few out. And it seems XNView also uses it.

that

AndyPix, ^^ A tough crowd tonight

AndyPix

that wrote: »

AndyPix, ^^ A tough crowd tonight

Hehe - that's ok im only spreading knowledge


Some folk prefer to have AVG installed to make them feel safe ..
The rest of us like to know about potential threats so we can act accordingly, and be actually safe

stragglebod

Surely installing AVG would make people feel old, rather than safe? IIRC it was the must-have antivirus around the turn of the millenium.

arciere

stragglebod wrote: »

Surely installing AVG would make people feel old, rather than safe? IIRC it was the must-have antivirus around the turn of the millenium.

Good one :rotfl:
I stopped using it ages ago, but I, too, remember when it was one of the best free AV on the market.
Then they started "integrating" all that rubbish stuff like identity protection, browser add-ons, ads messages here and there...