7-Zip: Multiple Memory Corruptions via RAR and ZIP

Post by carussell » Wed, Jan 24, 2018, 3:00 PM UTC

arka2147483647 wrote: post #4

carussell wrote: post #3

Two comments: The way its written, I first took the mention of finding this "during the analysis of a prominent antivirus product" to mean that you were reverse engineering some AV thing and found that it was scanning for this vulnerability (i.e., to protect against bad archives). After a second read, it seems like maybe not, and that the AV itself re-used parts of 7-zip for its own implementation and was therefore v…

It's common knowledge that AV programs scan files inside compressed archives. Obviously you need to run the decompression code to do that.

Post by katastic » Wed, Jan 24, 2018, 3:15 PM UTC

blattimwind wrote: post #8

arka2147483647 wrote: post #4

Earlier quoted context omitted.

It's common knowledge that AV programs scan files inside compressed archives. Obviously you need to run the decompression code to do that.

It's also common knowledge that the AV industry has a huge software quality and engineering problem ("let's unpack malware and emulate x86 in kernel space, because that never backfired before!").

Post by katastic » Wed, Jan 24, 2018, 3:21 PM UTC

katastic wrote: post #13

blattimwind wrote: post #8

Earlier quoted context omitted.

It's also common knowledge that the AV industry has a huge software quality and engineering problem ("let's unpack malware and emulate x86 in kernel space, because that never backfired before!").

I've actually heard many people (including one Chrome developer) that they don't even use AV anymore except Windows Defender because 99% of AV break Windows/applications by using non-standard hooks and may even introduce new vulnerabilities with their kernel drivers/etc. https://it.slashdot.org/story/17/02/01/1334219/google-chrome... Honestly, if they can't even stop viruses from infiltrating closed systems like Andr…

Post by sp332 » Wed, Jan 24, 2018, 3:22 PM UTC

katastic wrote: post #13

blattimwind wrote: post #8

Earlier quoted context omitted.

It's also common knowledge that the AV industry has a huge software quality and engineering problem ("let's unpack malware and emulate x86 in kernel space, because that never backfired before!").

I've actually heard many people (including one Chrome developer) that they don't even use AV anymore except Windows Defender because 99% of AV break Windows/applications by using non-standard hooks and may even introduce new vulnerabilities with their kernel drivers/etc. https://it.slashdot.org/story/17/02/01/1334219/google-chrome... Honestly, if they can't even stop viruses from infiltrating closed systems like Andr…

Post by hutzlibu » Wed, Jan 24, 2018, 3:31 PM UTC

katastic wrote: post #13

blattimwind wrote: post #8

Earlier quoted context omitted.

It's also common knowledge that the AV industry has a huge software quality and engineering problem ("let's unpack malware and emulate x86 in kernel space, because that never backfired before!").

I've actually heard many people (including one Chrome developer) that they don't even use AV anymore except Windows Defender because 99% of AV break Windows/applications by using non-standard hooks and may even introduce new vulnerabilities with their kernel drivers/etc. https://it.slashdot.org/story/17/02/01/1334219/google-chrome... Honestly, if they can't even stop viruses from infiltrating closed systems like Andr…