Timeline with a sane date format: 2017-12-29 - Discovery 2017-12-29 - Report 2017-12-29 - MITRE assigned CVE-2017-17969 2018-01-10 - Patched version 7-Zip 18.00 released
Thanks for pointing this out. I just fixed it.
7-Zip: Multiple Memory Corruptions via RAR and ZIP
21–30 of 106 posts
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#22Not turning on standard mitigation techniques because of binary size is one of the strangest reasons I've heard. And then still programming in an unsafe language, quite self-confident for a "humble programmer".
https://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340... It has already taught us a few lessons, and the one I have chosen to stress in this talk is the following. We shall do a much better programming job, provided that we approach the task with a full appreciation of its tremendous difficulty, provided that we stick to modest and elegant programming languages, provided that we respect the intrinsic limitations of the human mind and approach the task as Very Humble Programmers.
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#23Happy to have switched to WinRAR years ago. At least they do QA.
What software doesn't have bugs? This was discovered and it was patched in a timely fashion.
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#24Happy to have switched to WinRAR years ago. At least they do QA.
I am sure WinRAR has no bugs whatsoever, but would still like to see some evidence to that fact.
Some of the previous non-existent bugs:
http://seclists.org/fulldisclosure/2015/Sep/106 https://www.rarlab.com/vuln_zip_spoofing_4.20.html
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#25Happy to have switched to WinRAR years ago. At least they do QA.
...did you actually pay for it? You'd be part of a select group then :D
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#26Does the most recent version on the 7-Zip website, 18.00 beta, contain the patch? It's two weeks old. 7-Zip doesn't appear to contain an auto-updater or an "update me" button.
I find it a little bit concerning that the release note of V18.00 beta does not mention any fix for a security issues. I guess it's included in the "bug fixes"...
https://sourceforge.net/p/sevenzip/discussion/45797/thread/6...
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#27Earlier quoted context omitted.
I am sure WinRAR has no bugs whatsoever, but would still like to see some evidence to that fact.
Some of the previous non-existent bugs: http://seclists.org/fulldisclosure/2015/Sep/106 https://www.rarlab.com/vuln_zip_spoofing_4.20.html
> http://seclists.org/fulldisclosure/2015/Sep/106
This is not a vulnerability:
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#28Timeline with a sane date format: 2017-12-29 - Discovery 2017-12-29 - Report 2017-12-29 - MITRE assigned CVE-2017-17969 2018-01-10 - Patched version 7-Zip 18.00 released
7-Zip 18.00 is not really "released" at this time.
18.00 is marked as "beta" in the official website, and 16.04 is still at the top of the list. An average person trying to download 7-Zip right now will most likely choose the vulnerable version.
Beta versions of 7-Zip frequently stay in that status for months, if not years. Between 9.20 and 15.12, 7-Zip produced nothing but beta versions for 5 years. I understand the project moves slowly, but this is not a release model that facilitates quick dissemination of important security patches.
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#29Earlier quoted context omitted.
It's also common knowledge that the AV industry has a huge software quality and engineering problem ("let's unpack malware and emulate x86 in kernel space, because that never backfired before!").
I've actually heard many people (including one Chrome developer) that they don't even use AV anymore except Windows Defender because 99% of AV break Windows/applications by using non-standard hooks and may even introduce new vulnerabilities with their kernel drivers/etc. https://it.slashdot.org/story/17/02/01/1334219/google-chrome... Honestly, if they can't even stop viruses from infiltrating closed systems like Andr…
I don’t think I know of windows users that use anything other than defender these days on their personal machines, but I (am forced to) use McAfee on my work machine. I suspect that the enterprise tooling is better for third party AV and that’s the only thing other than inertia keeping corporate desktops on those old AV products.
Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP
#30Earlier quoted context omitted.
It's also common knowledge that the AV industry has a huge software quality and engineering problem ("let's unpack malware and emulate x86 in kernel space, because that never backfired before!").
I've actually heard many people (including one Chrome developer) that they don't even use AV anymore except Windows Defender because 99% of AV break Windows/applications by using non-standard hooks and may even introduce new vulnerabilities with their kernel drivers/etc. https://it.slashdot.org/story/17/02/01/1334219/google-chrome... Honestly, if they can't even stop viruses from infiltrating closed systems like Andr…
Well the definition of a "virus" have expanded greatly over the years.
The original definition was a piece of code that would latch onto binaries, and be spread that way. And those had telltale signatures (a virus may have added a jump at the start of the binary to the end, where a copy of the virus code resided, and then jumping back to the beginning of the actual program code).
And i am not so sure there is much distinction between visiting a JS heavy site and running a program locally these days. After all, we are seeing the likes of Google exposing USB and Bluetooth via JS APIs now.