Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

7-Zip: Multiple Memory Corruptions via RAR and ZIP

landave.io

Post reply on HN
Print view View original

31–40 of 106 posts

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#31

Post by da_chicken »

kijin wrote: post #28
jwilk wrote: post #16

Timeline with a sane date format: 2017-12-29 - Discovery 2017-12-29 - Report 2017-12-29 - MITRE assigned CVE-2017-17969 2018-01-10 - Patched version 7-Zip 18.00 released

7-Zip 18.00 is not really "released" at this time. 18.00 is marked as "beta" in the official website, and 16.04 is still at the top of the list. An average person trying to download 7-Zip right now will most likely choose the vulnerable version. Beta versions of 7-Zip frequently stay in that status for months, if not years. Between 9.20 and 15.12, 7-Zip produced nothing but beta versions for 5 years. I understand the…

> Between 9.20 and 15.12, 7-Zip produced nothing but beta versions for 5 years.

That's not all that surprising. The software was 10 years old when v9 came out and the major version number is just the year of release. There aren't 5 major releases that never got out of beta. The major version numbers in 7-Zip are misleading this way because the author doesn't really conform to standard conventions. Of course, that is pretty obvious once you use the software for awhile. It still doesn't properly support UAC.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#32

Post by jccalhoun »

kijin wrote: post #28
jwilk wrote: post #16

Timeline with a sane date format: 2017-12-29 - Discovery 2017-12-29 - Report 2017-12-29 - MITRE assigned CVE-2017-17969 2018-01-10 - Patched version 7-Zip 18.00 released

7-Zip 18.00 is not really "released" at this time. 18.00 is marked as "beta" in the official website, and 16.04 is still at the top of the list. An average person trying to download 7-Zip right now will most likely choose the vulnerable version. Beta versions of 7-Zip frequently stay in that status for months, if not years. Between 9.20 and 15.12, 7-Zip produced nothing but beta versions for 5 years. I understand the…

Yes, the way 7-zip releases are done is not ideal and the versioning scheme is just weird. I wish he would make his versioning clearer.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#35

Post by withinrafael »

Klasiaster wrote: post #22

Not turning on standard mitigation techniques because of binary size is one of the strangest reasons I've heard. And then still programming in an unsafe language, quite self-confident for a "humble programmer". https://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340... It has already taught us a few lessons, and the one I have chosen to stress in this talk is the following. We shall do a much better programming…

He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#36

Post by kbenson »

katastic wrote: post #13
blattimwind wrote: post #8

Earlier quoted context omitted.

It's also common knowledge that the AV industry has a huge software quality and engineering problem ("let's unpack malware and emulate x86 in kernel space, because that never backfired before!").

I've actually heard many people (including one Chrome developer) that they don't even use AV anymore except Windows Defender because 99% of AV break Windows/applications by using non-standard hooks and may even introduce new vulnerabilities with their kernel drivers/etc. https://it.slashdot.org/story/17/02/01/1334219/google-chrome... Honestly, if they can't even stop viruses from infiltrating closed systems like Andr…

I'm one of those people. I would be really interested in seeing what percentage of exploits, malware and spyware is caught by each feature of the common AV suite. I suspect that Defender is at the sweet spot.

Additionally, I see the entire AV market as a leech that was only able to grow as it had because Microsoft was able to shirk its responsibilities with respect to security for so long. Now that Microsoft are trying to handle the problem the AV companies are crying foul because they think they deserve the right to exist, which means Microsoft shouldn't do too much to help their own customers.

AV companies are the car dealerships of the digital realm. Superficial middlemen ensconced in a bygone era leeching money from the unwary. We should be careful, lest we legally formalize that relationship as we have with the dealerships.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#37

Post by leeter »

withinrafael wrote: post #35
Klasiaster wrote: post #22

Not turning on standard mitigation techniques because of binary size is one of the strangest reasons I've heard. And then still programming in an unsafe language, quite self-confident for a "humble programmer". https://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340... It has already taught us a few lessons, and the one I have chosen to stress in this talk is the following. We shall do a much better programming…

He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.

Or use a newer toolset than VC6 apparently. Honestly at this point there needs to be an intervention.

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#38

Post by chrisper »

withinrafael wrote: post #35
Klasiaster wrote: post #22

Not turning on standard mitigation techniques because of binary size is one of the strangest reasons I've heard. And then still programming in an unsafe language, quite self-confident for a "humble programmer". https://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340... It has already taught us a few lessons, and the one I have chosen to stress in this talk is the following. We shall do a much better programming…

He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.

Is there a good alternative to 7-zip?

Re: 7-Zip: Multiple Memory Corruptions via RAR and ZIP

#40

Post by vocatus_gate »

withinrafael wrote: post #35
Klasiaster wrote: post #22

Not turning on standard mitigation techniques because of binary size is one of the strangest reasons I've heard. And then still programming in an unsafe language, quite self-confident for a "humble programmer". https://www.cs.utexas.edu/~EWD/transcriptions/EWD03xx/EWD340... It has already taught us a few lessons, and the one I have chosen to stress in this talk is the following. We shall do a much better programming…

He won't go https, sign his binaries, or enable mark-of-web either. It's strange to see people still playing small binary golf in 2018.

Oh wow, I always assumed he just defaulted to HTTP version of the site, but HTTPS was an option. But nope, there isn't even a version of the site served over HTTPS. In the year 2018.
Post reply on HN