Are there any good alternatives to 7-zip we can use instead?
7-Zip: From Uninitialized Memory to Remote Code Execution
51–60 of 121 posts
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#52I have always used 7-Zip on Windows. Having done some reading now, the author's general attitude towards the tradeoff between security and executable size/speed have convinced me to try and not use it in the future. Thankfully I rarely have to use Windows these days.
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#53Earlier quoted context omitted.
I have previously read that for some reason the author disables most of the compiler options for things like ASLR and DEP I never managed to find out why edit: just found this: https://sourceforge.net/p/sevenzip/feature-requests/1270/ -- seems rather questionable considering MS give away the latest compilers for free
DEP was previously disabled because Igor used to compile 7-Zip with VC6, which doesn't support the /NXCOMPAT flag. I convinced him back in January to enable it for 7-Zip 18.01. Note, however, that 64-bit versions of Windows enforce DEP even if the /NXCOMPAT flag is missing. Since Windows 10, the 32-bit version does this as well. ASLR was primarily disabled because Igor wanted to strip the relocation from the binaries…
Why is this such an uphill battle?
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#54Earlier quoted context omitted.
EV Code signing certs get you immediate trust with Smart Screen. Recently discussed over on the bootstrapped forum: http://discuss.bootstrapped.fm/t/code-signing-certificate-re... Regular, non-EV code-signing certs, aren't as useful as they were when Vista / Windows 7 were the main Windows OSes.
Interesting, I wasn’t aware of that. However, isn’t getting an EV certificate impossible for a natural person? You’d have to be some sort of legally recognized organization. Not exactly suitable for small-scale Open Source development.
>However, isn’t getting an EV certificate impossible for a natural person? You’d have to be some sort of legally recognized organization
no? random example:
https://sourceforge.net/projects/keepass/files/KeePass%202.x...
signer is: "Open Source Developer, Dominik Reichl"
edit: another example
https://yarnpkg.com/latest.msi
signer is: "Daniel Lo Nigro"
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#557-Zip needs to start a Go Fund Me or similar for a Code Signing certificate. They're like $69-89/year, which is expensive, but for such a popular piece of software it would be a nice safety net in case of site compromise. Too bad none of the big CAs have an Open Source/Charity program that would provide a Authenticode Certificate for use with that software.
it's even cheaper if it's for an open source project: https://www.certum.eu/certum/cert,offer_en_open_source_cs.xm...
28 eur.
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#56Is there software running on Linux which is derived from the same source and is also vulnerable? Is this package vulnerable: https://packages.debian.org/sid/p7zip-rar https://packages.ubuntu.com/bionic/p7zip-rar ?
Debian (and Ubuntu as a downstream) patched out issues already: https://www.debian.org/security/2018/dsa-4104
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#57Is there software running on Linux which is derived from the same source and is also vulnerable? Is this package vulnerable: https://packages.debian.org/sid/p7zip-rar https://packages.ubuntu.com/bionic/p7zip-rar ?
Debian (and Ubuntu as a downstream) patched out issues already: https://www.debian.org/security/2018/dsa-4104
That's right, they patched CVE-2017-17969, which affected ZIP decompression. Interestingly, I believe they didn't patch CVE-2018-5996 (affecting RAR), which I published [0] on January 23 together with CVE-2017-17969.
[0]: https://landave.io/2018/01/7-zip-multiple-memory-corruptions...
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#58My guess: Because 7zip is not a good auto update software (does it even warn if there is a new version?) this security bug is HUGE! Just give you an example: Many Germans think that http://www.7-zip.de/ is the official site and you still download 16.04 there.
I just checked and I was on v9 from 8 years ago on my work pc. Why bother fixing security bugs etc if you're not going to roll them out? With other Windows software I get told about updates when I load them (winscp, Virtualbox) or they check and update themselves (Firefox).
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#59Earlier quoted context omitted.
Debian (and Ubuntu as a downstream) patched out issues already: https://www.debian.org/security/2018/dsa-4104
That's right, they patched CVE-2017-17969, which affected ZIP decompression. Interestingly, I believe they didn't patch CVE-2018-5996 (affecting RAR), which I published [0] on January 23 together with CVE-2017-17969. [0]: https://landave.io/2018/01/7-zip-multiple-memory-corruptions...
The Debian security team doesn’t patch packages from the non-free repository, like the 7-Zip RAR support:
https://www.debian.org/security/faq#contrib
That would have to wait for the maintainer to upload a new version and get it into a stable release.
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#60Why does anyone use 7-Zip? Does it have any advantages over the more widely used alternatives (tarball and zip)?