5

See:

It would seem according to these two sources that rar files can contain custom code thanks to the WinRAR virtual machine, which under normal circumstances may only access the data being uncompressed. What is intriguing however is that the following is mentioned in the RarVM Toolchain docs:

Known Bugs

There are several known bugs in the RarVM.

[redacted as some have security consequences]

Should we start considering RAR files insecure?

Improve this question
1
  • I don't think anyone here is going to be able to answer this question until the nature of those bugs is disclosed. Nonetheless, very cool question -- I enjoyed reading the material you linked to!
    – D.W.
    Sep 29, 2012 at 17:05

1 Answer 1

Reset to default
1

Note that in this case, what is deemed insecure is the RarVM implementation found in WinRAR, and probably not in the core design of the VM (if so, more interesting).

So you can either assume WinRar itself is insecure (something not improbable) or that all RAR files are insecure (more improbable than before).

What you do with this information, is probably nothing. You can decide you only accept ZIP files, but you're going to have trouble implementing that.

Improve this answer
2
  • The same implementation is being used by pretty much any compressing application with RAR support, isn't it? if this is the case whatever is broken "in" WinRAR will be broken in other compressors that handle RAR files.
    – Mahn
    Oct 2, 2012 at 14:59
  • Unlikely, seeing as WinRAR is closed source. Specification != implementation
    – Daniel Goldberg
    Oct 8, 2012 at 18:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .