Multiple 7-Zip Vulnerabilities Discovered

#1

Post by adamnemecek » Thu, May 12, 2016, 5:21 PM UTC

Multiple 7-Zip Vulnerabilities Discovered
blog.talosintel.com

Re: Multiple 7-Zip Vulnerabilities Discovered

#2

Post by hcs » Thu, May 12, 2016, 6:06 PM UTC

The discovered vulnerabilities are in the 7-Zip application's UDF and HFS+ filesystem image support.

Re: Multiple 7-Zip Vulnerabilities Discovered

#3

Post by striking » Thu, May 12, 2016, 6:23 PM UTC

hcs wrote: post #2

The discovered vulnerabilities are in the 7-Zip application's UDF and HFS+ filesystem image support.

I didn't even realize 7-Zip could open those.

Re: Multiple 7-Zip Vulnerabilities Discovered

#4

Post by mamurphy » Thu, May 12, 2016, 6:25 PM UTC

I'm a tad confused. Say I had 7-zip installed - how would I be vulnerable? Hacker Henry knows I use UDF or HFS+ filesystem, AND gets me to trust them and download their maliciously compressed file, AND I extract it with 7-zip, which is exploited by one of these vulnerabilities?

If Henry can do all that, why couldn't Henry just get me to trust them and download a more robust malicious file in the first place without worry to what type of filesystem and decompression software I use?

Re: Multiple 7-Zip Vulnerabilities Discovered

#5

Post by infogulch » Thu, May 12, 2016, 6:28 PM UTC

striking wrote: post #3

hcs wrote: post #2

The discovered vulnerabilities are in the 7-Zip application's UDF and HFS+ filesystem image support.

I didn't even realize 7-Zip could open those.

7-Zip is the VLC of file containers.

Re: Multiple 7-Zip Vulnerabilities Discovered

#6

Post by adamnemecek » Thu, May 12, 2016, 6:28 PM UTC

mamurphy wrote: post #4

I'm a tad confused. Say I had 7-zip installed - how would I be vulnerable? Hacker Henry knows I use UDF or HFS+ filesystem, AND gets me to trust them and download their maliciously compressed file, AND I extract it with 7-zip, which is exploited by one of these vulnerabilities? If Henry can do all that, why couldn't Henry just get me to trust them and download a more robust malicious file in the first place without w…

What exactly do you mean by more robust malicious file? Like an executable? Because I'm relatively OK with extracting files from dubious sources, I'm not OK with running executables from dubious sources.

Re: Multiple 7-Zip Vulnerabilities Discovered

#7

Post by lqdc13 » Thu, May 12, 2016, 6:29 PM UTC

mamurphy wrote: post #4

I'm a tad confused. Say I had 7-zip installed - how would I be vulnerable? Hacker Henry knows I use UDF or HFS+ filesystem, AND gets me to trust them and download their maliciously compressed file, AND I extract it with 7-zip, which is exploited by one of these vulnerabilities? If Henry can do all that, why couldn't Henry just get me to trust them and download a more robust malicious file in the first place without w…

Many people put more trust in unzipping something than running untrusted code.

Archives are supposed to be read only.

Re: Multiple 7-Zip Vulnerabilities Discovered

#8

Post by excalibur » Thu, May 12, 2016, 6:39 PM UTC

mamurphy wrote: post #4

I'm a tad confused. Say I had 7-zip installed - how would I be vulnerable? Hacker Henry knows I use UDF or HFS+ filesystem, AND gets me to trust them and download their maliciously compressed file, AND I extract it with 7-zip, which is exploited by one of these vulnerabilities? If Henry can do all that, why couldn't Henry just get me to trust them and download a more robust malicious file in the first place without w…

Because Henry is Hardcore.

Re: Multiple 7-Zip Vulnerabilities Discovered

#9

Post by giancarlostoro » Thu, May 12, 2016, 6:41 PM UTC

infogulch wrote: post #5

striking wrote: post #3

Earlier quoted context omitted.

I didn't even realize 7-Zip could open those.

7-Zip is the VLC of file containers.

It is my default whenever I'm on Windows. Everyone loves to close the "trial" window on software when there's usually a better open source alternative. The hidden gem in 7-Zip is you can set file association, it's just not enabled by default which makes it seem more complicated to newcomers than it really is.

Re: Multiple 7-Zip Vulnerabilities Discovered

#10

Post by kbenson » Thu, May 12, 2016, 6:42 PM UTC

adamnemecek wrote: post #6

mamurphy wrote: post #4

I'm a tad confused. Say I had 7-zip installed - how would I be vulnerable? Hacker Henry knows I use UDF or HFS+ filesystem, AND gets me to trust them and download their maliciously compressed file, AND I extract it with 7-zip, which is exploited by one of these vulnerabilities? If Henry can do all that, why couldn't Henry just get me to trust them and download a more robust malicious file in the first place without w…

What exactly do you mean by more robust malicious file? Like an executable? Because I'm relatively OK with extracting files from dubious sources, I'm not OK with running executables from dubious sources.

Yes, there are trust levels associated with running untrusted code, and processing untrusted data. It's possible (but often hard and annoying) to access some external/untrusted resources such as the internet and items on them without running untrusted code, it is not possible to do so without processing untrusted data (at a minimum it's going to traverse your network stack and display/disk drivers).