Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

See:

It would seem according to these two sources that rar files can contain custom code thanks to the WinRAR virtual machine, which under normal circumstances may only access the data being uncompressed. What is intriguing however is that the following is mentioned in the RarVM Toolchain docs:

Known Bugs

There are several known bugs in the RarVM.

[redacted as some have security consequences]

Should we start considering RAR files insecure?

share|improve this question
    
I don't think anyone here is going to be able to answer this question until the nature of those bugs is disclosed. Nonetheless, very cool question -- I enjoyed reading the material you linked to! –  D.W. Sep 29 '12 at 17:05
add comment

1 Answer

Note that in this case, what is deemed insecure is the RarVM implementation found in WinRAR, and probably not in the core design of the VM (if so, more interesting).

So you can either assume WinRar itself is insecure (something not improbable) or that all RAR files are insecure (more improbable than before).

What you do with this information, is probably nothing. You can decide you only accept ZIP files, but you're going to have trouble implementing that.

share|improve this answer
    
The same implementation is being used by pretty much any compressing application with RAR support, isn't it? if this is the case whatever is broken "in" WinRAR will be broken in other compressors that handle RAR files. –  Mahn Oct 2 '12 at 14:59
    
Unlikely, seeing as WinRAR is closed source. Specification != implementation –  Daniel Goldberg Oct 8 '12 at 18:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.