Publication of a 0day exploit in WinRAR

Publication of a 0day exploit in WinRAR

For informational purposes only

Type of vulnerability: A check error for the return value of fread, leading to a fallback to a weak PRNG based on system time and CPU clock (CWE-330) Affected platforms: RAR archives encrypted on Linux, macOS, BSD

The hacker described a 0day in the cryptographic subsystem of WinRAR/UnRAR for Unix — in the code responsible for generating a salt for AES encryption of archives. According to the description, the check for the success of reading 16 bytes from /dev/urandom is not implemented correctly, as a result of which correctly read "normal" bytes are then overwritten with values from a backup function derived from a single 64-bit word based on system time and CPU clock. According to the author, the consequences are:

— Every RAR archive encrypted on Linux/macOS/BSD uses a salt with an effective entropy of about 25 bits instead of the nominal 128. With a known approximate date of archive creation, the possible range of salt values is sufficiently reduced to make attacks with precalculated tables and accelerated brute-force realistic.

— Brute-force password recovery of an intercepted archive is possible. The scheme itself is structurally weakened, which reduces the actual resistance of even good passwords.

WinRAR is one of the most widespread archivers in the world: according to data from RARLab itself, the product is translated into more than 50 languages and is used on hundreds of millions of devices. Similar bugs with entropy sources have historically been fixed in Debian OpenSSL (2008) and a number of other cryptographic libraries (and retroactively devalued huge arrays of already generated cryptographic material).