19-Year-Old Vulnerability Discovered in WinRAR

The most recent beta version of WinRAR resolves a vulnerability that has been around for no less than 19 years, potentially putting all users of the applications at risk.

WinRAR, which is currently the top compression tool on the market, comes with a security bug that makes it possible for attackers to hide malicious files in archives that are then added to the startup folder for persistence.

Discovered by Check Point Software Technologies, the vulnerability resides in the ACE archive format, which itself is based on a library last updated in 2005. According to the research, an attacker can create an ACE file and then rename it to the RAR format.

When extracting files, a malicious item included in the archive can be automatically added to the startup folder, so attackers can obtain persistence and make sure it runs every time the computer boots.

In some cases, malware can be dete...