Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Multiple 7-Zip Vulnerabilities Discovered

blog.talosintel.com

Post reply on HN
Print view View original

11–20 of 72 posts

Re: Multiple 7-Zip Vulnerabilities Discovered

#11

Post by nwah1 »

giancarlostoro wrote: post #9
infogulch wrote: post #5

Earlier quoted context omitted.

7-Zip is the VLC of file containers.

It is my default whenever I'm on Windows. Everyone loves to close the "trial" window on software when there's usually a better open source alternative. The hidden gem in 7-Zip is you can set file association, it's just not enabled by default which makes it seem more complicated to newcomers than it really is.

PeaZip is like a friendly version of 7zip, and uses the 7zip code. 7zip is not very well maintained, whereas PeaZip has regular releases.

Re: Multiple 7-Zip Vulnerabilities Discovered

#12

Post by laumars »

mamurphy wrote: post #4

I'm a tad confused. Say I had 7-zip installed - how would I be vulnerable? Hacker Henry knows I use UDF or HFS+ filesystem, AND gets me to trust them and download their maliciously compressed file, AND I extract it with 7-zip, which is exploited by one of these vulnerabilities? If Henry can do all that, why couldn't Henry just get me to trust them and download a more robust malicious file in the first place without w…

The vulnerability isn't to do with what file system you're running, it's to do with using 7-zip to view the contents of archives in those file formats. Which means if someone wanted to view ala DVD ".iso" which used the UDF specification, then they could be vulnerable if they use 7-zip.

I remember it used to be common place to open .iso files with WinRar back in the 90s. I wouldn't be surprised if a sizeable number of people now use 7-zip similarly

Re: Multiple 7-Zip Vulnerabilities Discovered

#13

Post by Animats »

Now this is a case for sandboxing. A decompressor has one input file and one output directory. It should not have the power to change any state outside those files.

A key point here is that not all code needs to be secure. Some code just needs to be kept in a box.

Re: Multiple 7-Zip Vulnerabilities Discovered

#14

Post by arkitaip »

giancarlostoro wrote: post #9
infogulch wrote: post #5

Earlier quoted context omitted.

7-Zip is the VLC of file containers.

It is my default whenever I'm on Windows. Everyone loves to close the "trial" window on software when there's usually a better open source alternative. The hidden gem in 7-Zip is you can set file association, it's just not enabled by default which makes it seem more complicated to newcomers than it really is.

Not really sure why you would need regular releases for handing zip files, though.

Re: Multiple 7-Zip Vulnerabilities Discovered

#15

Post by paulfr »

I am appalled at how unseriously 7-zip seems to take security.

The changelog only says "Some bugs were fixed", with no mention that there are serious security flaws. The homepage doesn't mention any vulnerability.

The installer is not signed, downloads are over HTTP only, and there is no hash available neither on the homepage or on the forum announcement linked from the homepage (the latter is served over HTTPS so it would be a reasonable option); thankfully you can dig around Sourceforge downloads to find a SHA-1 automatically generated by Sourceforge. So I can personally verify the integrity of downloads, assuming Sourceforge can still be trusted, but 99% of users won't do this, and more worryingly it's a strong signal that the developers may not understand or value security very much: you have to wonder if maybe they're not themselves downloading unsigned software over HTTP all the time.

Re: Multiple 7-Zip Vulnerabilities Discovered

#16

Post by mentat »

Animats wrote: post #13

Now this is a case for sandboxing. A decompressor has one input file and one output directory. It should not have the power to change any state outside those files. A key point here is that not all code needs to be secure. Some code just needs to be kept in a box.

Same with transcoders

Re: Multiple 7-Zip Vulnerabilities Discovered

#17

Post by paulfr »

laumars wrote: post #12
mamurphy wrote: post #4

I'm a tad confused. Say I had 7-zip installed - how would I be vulnerable? Hacker Henry knows I use UDF or HFS+ filesystem, AND gets me to trust them and download their maliciously compressed file, AND I extract it with 7-zip, which is exploited by one of these vulnerabilities? If Henry can do all that, why couldn't Henry just get me to trust them and download a more robust malicious file in the first place without w…

The vulnerability isn't to do with what file system you're running, it's to do with using 7-zip to view the contents of archives in those file formats. Which means if someone wanted to view ala DVD ".iso" which used the UDF specification, then they could be vulnerable if they use 7-zip. I remember it used to be common place to open .iso files with WinRar back in the 90s. I wouldn't be surprised if a sizeable number o…

I just did some testing and it's even worse than that: 7-zip completely ignores the file extension and snoops the file format based on the file contents only.

So simply opening a malicious ".zip" file on Windows could trigger the HFS+ vulnerability. Using 7-zip to open any file means you have a HUGE attack surface.

EDIT: One simple way to mitigate this issue would be to just throw a confirmation prompt if the file extension matches a known format but 7-zip is about to run a decoder for a different format.

Re: Multiple 7-Zip Vulnerabilities Discovered

#18

Post by poizan42 »

nwah1 wrote: post #11
giancarlostoro wrote: post #9

Earlier quoted context omitted.

It is my default whenever I'm on Windows. Everyone loves to close the "trial" window on software when there's usually a better open source alternative. The hidden gem in 7-Zip is you can set file association, it's just not enabled by default which makes it seem more complicated to newcomers than it really is.

PeaZip is like a friendly version of 7zip, and uses the 7zip code. 7zip is not very well maintained, whereas PeaZip has regular releases.

> 7zip is not very well maintained, whereas PeaZip has regular releases.

16.00 2016-05-10

15.14 2015-12-31

15.12 2015-11-19

15.11 beta 2015-11-14

15.10 beta 2015-11-01

15.09 beta 2015-10-16

15.08 beta 2015-10-01

15.07 beta 2015-09-17

...

How is that not regular?

Re: Multiple 7-Zip Vulnerabilities Discovered

#19

Post by [deleted] »

nwah1 wrote: post #11
giancarlostoro wrote: post #9

Earlier quoted context omitted.

It is my default whenever I'm on Windows. Everyone loves to close the "trial" window on software when there's usually a better open source alternative. The hidden gem in 7-Zip is you can set file association, it's just not enabled by default which makes it seem more complicated to newcomers than it really is.

PeaZip is like a friendly version of 7zip, and uses the 7zip code. 7zip is not very well maintained, whereas PeaZip has regular releases.

[deleted]

Re: Multiple 7-Zip Vulnerabilities Discovered

#20

Post by lqdc13 »

paulfr wrote: post #15

I am appalled at how unseriously 7-zip seems to take security. The changelog only says "Some bugs were fixed", with no mention that there are serious security flaws. The homepage doesn't mention any vulnerability. The installer is not signed, downloads are over HTTP only, and there is no hash available neither on the homepage or on the forum announcement linked from the homepage (the latter is served over HTTPS so it…

There are plenty of ways of defeating authenticode sig.

They should have hashes though.

Post reply on HN