A recently disclosed high-severity security flaw in the WinRAR utility has been successfully addressed, reducing the risk of hackers gaining control of Windows systems through remote code execution.
Identified as CVE-2023-40477, this vulnerability, carrying a CVSS score of 7.8, was the result of improper validation when processing recovery volumes. The Zero Day Initiative (ZDI) elaborated on the issue, stating, “The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.”
To exploit this flaw, user interaction is required, meaning the target must either be enticed into visiting a malicious webpage or tricked into opening a booby-trapped archive file.
The credit for discovering and reporting this vulnerability goes to a security researcher operating under the pseudonym “goodbyeselene,” who detected the issue on June 8, 2023. The problem has since been addressed in WinRAR 6.23, released on August 2, 2023.
The software maintainers noted, “A security issue involving an out-of-bounds write has been fixed in RAR4 recovery volumes processing code.”
Additionally, the latest version of WinRAR rectifies another issue where “WinRAR could start a wrong file after a user double-clicked an item in a specially crafted archive.” This problem was reported by Group-IB researcher Andrey Polovinkin.
To enhance security and minimize potential threats, users are strongly advised to update their WinRAR software to the latest version.
