Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

7-Zip: Multiple Memory Corruptions via RAR and ZIP

landave.io

Post reply on HN
Print view View original

1–10 of 106 posts

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#3

Post by carussell »

Two comments:

The way its written, I first took the mention of finding this "during the analysis of a prominent antivirus product" to mean that you were reverse engineering some AV thing and found that it was scanning for this vulnerability (i.e., to protect against bad archives). After a second read, it seems like maybe not, and that the AV itself re-used parts of 7-zip for its own implementation and was therefore vulnerable itself. Still not sure, though.

The way the stylesheet makes the "rendered" form (especially section headings) resemble markdown source is pretty neat.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#4

Post by arka2147483647 »

carussell wrote: post #3

Two comments: The way its written, I first took the mention of finding this "during the analysis of a prominent antivirus product" to mean that you were reverse engineering some AV thing and found that it was scanning for this vulnerability (i.e., to protect against bad archives). After a second read, it seems like maybe not, and that the AV itself re-used parts of 7-zip for its own implementation and was therefore v…

It's common knowledge that AV programs scan files inside compressed archives. Obviously you need to run the decompression code to do that.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#5

Post by landave »

carussell wrote: post #3

Two comments: The way its written, I first took the mention of finding this "during the analysis of a prominent antivirus product" to mean that you were reverse engineering some AV thing and found that it was scanning for this vulnerability (i.e., to protect against bad archives). After a second read, it seems like maybe not, and that the AV itself re-used parts of 7-zip for its own implementation and was therefore v…

You are completely right with the first comment. The antivirus product itself reuses parts of 7-Zip and is vulnerable itself. I mentioned this mainly because I did not analyze the original 7-Zip software, but only discovered that it was affected as well after I had found the bug in this antivirus product.

I admit that this is confusing, so I'll probably try to rephrase this.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#6

Post by landave »

d33 wrote: post #2

Why wasn't it found with afl-fuzz?

The RAR PPMd bug can only be triggered if many conditions are satisfied. For example, the RAR archive needs to be mostly correctly structured, and needs to have at least two items that are compressed with the right flags (e.g., RAR version 3, PPMd). Furthermore, the compressed streams need to be constructed such that the bugs are triggered. Hence, I believe the bug is difficult to hit with straightforward coverage-guided fuzzing.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#8

Post by blattimwind »

arka2147483647 wrote: post #4
carussell wrote: post #3

Two comments: The way its written, I first took the mention of finding this "during the analysis of a prominent antivirus product" to mean that you were reverse engineering some AV thing and found that it was scanning for this vulnerability (i.e., to protect against bad archives). After a second read, it seems like maybe not, and that the AV itself re-used parts of 7-zip for its own implementation and was therefore v…

It's common knowledge that AV programs scan files inside compressed archives. Obviously you need to run the decompression code to do that.

It's also common knowledge that the AV industry has a huge software quality and engineering problem ("let's unpack malware and emulate x86 in kernel space, because that never backfired before!").

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#10

Post by landave »

ccleve wrote: post #9

Does the most recent version on the 7-Zip website, 18.00 beta, contain the patch? It's two weeks old. 7-Zip doesn't appear to contain an auto-updater or an "update me" button.

Yes, 18.00 beta is the patched version. The current release (non-beta) version is not patched yet. Moreover, the POSIX port of p7zip is not patched yet at all.
Post reply on HN