So I finally updated WinRAR yesterday. First time in, I dont even know, three years? Maybe four. And the only reason I did it is because of a bug that's apparently been sitting there since the year 2000.
Check Point Research put out a writeup a couple weeks back about a flaw in a DLL called UNACEV2.dll, the bit of WinRAR that handles old ACE-format archives. Turns out it had an absolute path traversal bug in it this whole time, meaning a maliciously crafted ACE file (you could even rename it .rar and it'd still get parsed by the same code) could drop an executable wherever it wanted on your system. Startup folder is the obvious target. Extract one bad archive, do nothing else, reboot your machine later, and now you're infected. No exploit chain, no macros, nothing clever. Just WinRAR doing exactly what its 19-year-old code told it to do.
Nineteen years. Think about that for a second. That DLL has been quietly riding along inside one of the most-installed pieces of Windows software on the planet since before the iPod existed, and nobody caught it until Check Point went digging through it with their own tools last month.
The fix, and this is the part I find kind of funny, isnt actually a patch. WinRAR doesnt even have the source code for UNACEV2.dll anymore (it was written by a third party ages ago), so instead of fixing the bug they just ripped the whole thing out. Version 5.70 beta drops ACE support entirely. If you want to unpack an ACE file now you're out of luck, which, fine, when's the last time anyone actually used ACE format for anything. RAR and ZIP ate that whole category alive a decade ago.
Anyway, this is what finally got me to click through that nag screen I've been dismissing since forever. You know the one, the "your trial has expired, please consider purchasing a license" box that pops up every single time you open the app, that literally nobody I have ever met has paid for. WinRAR's whole business model has been vibes-based honor system nagware for like two decades and somehow it still works, the company's still around, so good for them I guess. I dont think Ive ever met a single human being who paid the $29.
What actually bugs me about this whole thing isnt WinRAR specifically, its more the general fact that so much of what we run every day is bundled up out of some ancient utility library that one guy wrote once and nobody's looked at closely since. Half the file-format parsers on your machine right now are probably older than some of the people reading this. Nobody audits that stuff until a researcher trips over it, and then everyone acts surprised. My download folder alone had eleven RAR files in it I couldnt tell you the origin of if you asked me. Some of them are probably years old. I have no idea if any were the vulnerable kind, and honestly thats the unsettling part, you just dont know what old formats are quietly still in there until someone tells you to go check.
If youre running anything older than 5.70 beta 1, go grab the new build. And if youre one of the (I assume large) number of people running some version from 2015 because it still technically works and why fix what isnt broken, this is your reminder that "still technically works" and "safe" arent the same category of thing. Old software doesnt get worse over time in any way you can see. It just accumulates risk quietly until somebody publishes a paper about it.
Also, completely unrelated but I have to mention it because it happened literally this morning while I was writing this: Zuckerberg dropped a few-thousand-word post about pivoting Facebook toward "privacy-focused" messaging, encryption across all their apps, the whole thing. I'm not going to get into it here, everyone and their mother is writing that post today and mine would just be noise on top of noise. Maybe I'll have more to say once we see if any of it actually ships.
Go update your archive software. Thats the whole post really.