WinRAR Removes ACE Support to fix 19-Year-Old Vulnerability

[smed79]

WinRAR Removes ACE Support to fix 19-Year-Old Vulnerability

Nadav Grossman from Check Point Software Technologies informed us
about a security vulnerability in UNACEV2.DLL library.
Aforementioned vulnerability makes possible to create files
in arbitrary folders inside or outside of destination folder
when unpacking ACE archives.

WinRAR used this third party library to unpack ACE archives.
UNACEV2.DLL had not been updated since 2005 and we do not have access
to its source code. So we decided to drop ACE archive format support
to protect security of WinRAR users.

Check Point Research blog post detailing how it works
https://research.checkpoint.com/extract ... om-winrar/

Video demo
https://www.youtube.com/watch?v=R2qcBWJzHMo

Update WinRAR
https://www.rarlab.com/download.htm