I was diagnosed with Parkinson's disease nearly 4 years ago, at 51. I had a stooped posture, tremors, muscle stiffness, sleeplessness, slow movement. I was placed on Sinemet for 7 months and then Sifrol and Rotigotine was introduced which replaced the Sinemet but I had to stop due to side effects. Last year, I started on Parkinsons disease herbal treatment from Madida Herbal Clinic, this natural herbal treatment totally reversed my Parkinsons disease. Visit www.madidaherbalcenter.weebly.com or email madidaherbalcenter@gmail.com. The treatment worked incredibly for my Parkinsons disease, i have a total decline in symptoms including tremors, stiffness, slow movement and others.
7-Zip: From Uninitialized Memory to Remote Code Execution
111–120 of 121 posts
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#112Hi all, In 18.01 Igor had fixed CVE-2018-5996 with adding some variable like _errorMode or m_TablesOK. And in 18.05 I don't see this variables. Igor was replace it by _solidAllowed to fix CVE-2018-10115. Does it fix for both CVE-2018-5996 and CVE-2018-10115? Thank you
I think this is correct. Since _solidAllowed is set to false at the beginning of Code(), it will remain false if an exception occurs in the middle of decoding (CVE-2018-5996). This will enforce PpmError being set to true for the next item, which in turn will enforce the (possibly broken) PPMD state to be reinitialized. In some sense, this means that the new bug fix is a generalization of the first one, fixing both CVE-2018-5996 and CVE-2018-10115.
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#113Earlier quoted context omitted.
Because there are multiple conflicting priorities here. On the one hand, it is good to keep software updated, and therefore software should check for updates. On the other hand, software should restrict itself to solving one problem domain. Interacting with the internet is something wholly distinct from decompressing files, and so the software should not branch off into a new domain. Choosing between these priorities…
Assuming I agree with you, what's the reason for not telling me about updates when I run the app? What's the advantage of the decision they've taken which is to not announce this?
Because even determining that there is an update available requires checking against an outside source to see if an update is available. This requires internet access, which requires handling network protocols, network security and encryption, none of which have anything to do with file compression. Increasing the scope of a project introduces additional failure modes, and a larger security risk.
If a project already performs telemetry, or if they have developer announcements, then the project has already increased its scope, and checking for updates is a relatively minor addition. If it is a well-behaved stand-alone application that doesn't make unwarranted external connections, then checking for updates is a large increase of scope.
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#114Earlier quoted context omitted.
Why is this such an uphill battle?
Developer cares about efficiency. It seems strange in today's world of Electron apps and text editors that take up a GB of ram and have hundreds of ms of latency, but that's clearly where his priorities lie and I, for one, can respect that. If people are so up in arms about the security problems of 7-Zip, they're free to fork it.
Comparing javascript to ASLR is nonsensical.
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#115Is there software running on Linux which is derived from the same source and is also vulnerable? Is this package vulnerable: https://packages.debian.org/sid/p7zip-rar https://packages.ubuntu.com/bionic/p7zip-rar ?
Debian (and Ubuntu as a downstream) patched out issues already: https://www.debian.org/security/2018/dsa-4104
Ubuntu doesn't get these patches, unless some non-Canonical volunteer puts in the effort to prepare a package and get a sponsor from Canonical. Future version of ubuntu will eventually get the fix because Ubuntu it will be forked off from a sufficiently new version of Debian.
here's the status of your DSA's vulnerability in Ubuntu: https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2...
Here's the status of the post's vulnerability in Ubuntu: https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2...
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#116[deleted]
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#117Since Ubuntu and Debian are affected,so CentOS is affected too?
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#118There were some misunderstandings that I want to clear up (maybe I will add them in an update to the blog post): 1. Some people mentioned that this would "only affect RAR files" and it would be safe to extract 7z files with 7-Zip prior to version 18.05. This is wrong, because 7-Zip detects the file type from the magic numbers at the beginning of the file. So the exploit can be renamed to 'exploit.7z' and it works jus…
hmmm is there any way for a end user to know what version of the dll is a problem?
The enterprise deployment of Trend Micro Officescan I have has the 7z.dll (7za.dll) version 4.57
To me that looks like quite an old version... Probably open to this exploit.
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#119My guess: Because 7zip is not a good auto update software (does it even warn if there is a new version?) this security bug is HUGE! Just give you an example: Many Germans think that http://www.7-zip.de/ is the official site and you still download 16.04 there.
I just checked and I was on v9 from 8 years ago on my work pc. Why bother fixing security bugs etc if you're not going to roll them out? With other Windows software I get told about updates when I load them (winscp, Virtualbox) or they check and update themselves (Firefox).
Old thread, but I'd like to point at http://scoop.sh [1] which provides a command line package manager for Windows - and allows easy update of packages.
Chocolatey is similar in some ways, but scoop works hard to isolate installed apps from each others, and from other users (which can be good and bad). It's a little like an apt-like wrapper for binary-only (x)stow.
[1] scoop is hosted on github - the download url is on proper ssl, the bare scoop.sh domain presents a github-cert.
Re: 7-Zip: From Uninitialized Memory to Remote Code Execution
#120Hi all, In 18.01 Igor had fixed CVE-2018-5996 with adding some variable like _errorMode or m_TablesOK. And in 18.05 I don't see this variables. Igor was replace it by _solidAllowed to fix CVE-2018-10115. Does it fix for both CVE-2018-5996 and CVE-2018-10115? Thank you
I think this is correct. Since _solidAllowed is set to false at the beginning of Code(), it will remain false if an exception occurs in the middle of decoding (CVE-2018-5996). This will enforce PpmError being set to true for the next item, which in turn will enforce the (possibly broken) PPMD state to be reinitialized. In some sense, this means that the new bug fix is a generalization of the first one, fixing both CV…
Thank you!