Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

7-Zip: From Uninitialized Memory to Remote Code Execution

landave.io

Post reply on HN
Print view View original

71–80 of 121 posts

Re: 7-Zip: From Uninitialized Memory to Remote Code Execution

#71

Post by mschwaig »

MereInterest wrote: post #62
superflyguy wrote: post #58

Earlier quoted context omitted.

I just checked and I was on v9 from 8 years ago on my work pc. Why bother fixing security bugs etc if you're not going to roll them out? With other Windows software I get told about updates when I load them (winscp, Virtualbox) or they check and update themselves (Firefox).

Because there are multiple conflicting priorities here. On the one hand, it is good to keep software updated, and therefore software should check for updates. On the other hand, software should restrict itself to solving one problem domain. Interacting with the internet is something wholly distinct from decompressing files, and so the software should not branch off into a new domain. Choosing between these priorities…

Windows is special here because Microsoft never properly solved the distribution problem for software.

If you want the typical user on Windows to run updated software, your software has to at least entice updating if not auto-update straight away.

Not solving this whole distribution mess is by far the worst downside of Windows as a platform. Not getting malware when installing software on your Windows PC is hard.

Re: 7-Zip: From Uninitialized Memory to Remote Code Execution

#72

Post by pfg »

drzaiusapelord wrote: post #65
jessaustin wrote: post #8

Earlier quoted context omitted.

This includes various anti-virus software. It's fascinating that this category of equipment, which searches for viruses by running untrusted code , is still regularly installed in all corners of valuable networks.

What AVs use this? I keep hearing horrible things about AVs but little proof. I know Tavis from Google finds bugs and AV in rare cases can reduce security, but that's a far cry from them embedding FOSS projects to save time. For AV companies writing a rar parser is a single-day activity, its hard to believe they need this app. The few places I've seen 7z used is in installers where the input is known (installer archi…

I don't know about 7-Zip specifically, but AV vendors use plenty of FOSS code. Here's some findings just from Google's P0 showing that Symantec[1], Bitdefender[2], Microsoft[3] and Avast[4] all use unrar in their products. It wouldn't be far-fetched to assume some might use 7-Zip for other archive formats.

[1]: https://bugs.chromium.org/p/project-zero/issues/detail?id=81...

[2]: https://bugs.chromium.org/p/project-zero/issues/detail?id=12...

[3]: https://bugs.chromium.org/p/project-zero/issues/detail?id=15...

[4]: https://bugs.chromium.org/p/project-zero/issues/detail?id=57...

Re: 7-Zip: From Uninitialized Memory to Remote Code Execution

#74

Post by RaleyField »

RaleyField wrote: post #42
blibble wrote: post #28

Earlier quoted context omitted.

> You're just asking for too much. I know it's not you saying this, but it's very strange given almost all files 7-zip will ever see are untrusted files downloaded from the internet I'd rather have it be 1% slower than be compromised!

For virtually everybody even 500% slower would be acceptable. 1% is 10 second, one-time cost, which is objectively a fool's bargain.

Why am I getting downvoted? I sincerely wonder what is so objectionable in my comment. Most uses of 7-zip are one-off events that last around a minute long. Most users aren't decompressing terabyte-range files. It makes no fracking difference to users if they have to wait 5 minutes or 1 minute. But it makes a difference if they receive 7z archive and get their bank account cleaned because the author prematurely optimized his program on a 20 year old compiler. If there was ever a reasonable situation where security flags could be disable then client-side decompression utilities aren't one. Anyone who needs that 5% performance improvement can compile the library themselves. This is what is wrong with this industry.

Re: 7-Zip: From Uninitialized Memory to Remote Code Execution

#75

Post by nsuser3 »

therealmarv wrote: post #11

My guess: Because 7zip is not a good auto update software (does it even warn if there is a new version?) this security bug is HUGE! Just give you an example: Many Germans think that http://www.7-zip.de/ is the official site and you still download 16.04 there.

> Because 7zip is not a good auto update software

Updates should be handled by the OS anyway IMO

Re: 7-Zip: From Uninitialized Memory to Remote Code Execution

#76

Post by RaleyField »

sandos wrote: post #34
landave wrote: post #27

Earlier quoted context omitted.

HE-ASLR I am discussing with him right now, and I think we will get this. But honestly, I don't think we will ever see a 7-Zip with /GS or CFG. Not only would this cost about 1% in binary size, it would cost an additional 1% in runtime performance loss. Additionally, it would require compiling 7-Zip with a modern compiler like VS2017. You're just asking for too much.

Why is that asking too much? I realize paying for software is not something everyone wants, but doesnt the free versions of VS work for compiling 7-zip?

> Why is that asking too much?

Dunno, just as with FB/CA, users have agreed to what befell them. Relevant extract from LGPL 2.1: "THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE LIBRARY IS WITH YOU."

EDIT: /s, ...

Re: 7-Zip: From Uninitialized Memory to Remote Code Execution

#77

Post by mr_toad »

nsuser3 wrote: post #75
therealmarv wrote: post #11

My guess: Because 7zip is not a good auto update software (does it even warn if there is a new version?) this security bug is HUGE! Just give you an example: Many Germans think that http://www.7-zip.de/ is the official site and you still download 16.04 there.

> Because 7zip is not a good auto update software Updates should be handled by the OS anyway IMO

Can’t see that happening on Windows soon, if ever.

Re: 7-Zip: From Uninitialized Memory to Remote Code Execution

#78

Post by EvilTerran »

MereInterest wrote: post #62
superflyguy wrote: post #58

Earlier quoted context omitted.

I just checked and I was on v9 from 8 years ago on my work pc. Why bother fixing security bugs etc if you're not going to roll them out? With other Windows software I get told about updates when I load them (winscp, Virtualbox) or they check and update themselves (Firefox).

Because there are multiple conflicting priorities here. On the one hand, it is good to keep software updated, and therefore software should check for updates. On the other hand, software should restrict itself to solving one problem domain. Interacting with the internet is something wholly distinct from decompressing files, and so the software should not branch off into a new domain. Choosing between these priorities…

A real-life example of the risk of automatic updates: about a decade ago, the maintainers of the Shareaza multi-protocol p2p client lost control of their domain, and the new owners of the domain pushed their own (sleazy, commercial) software to unsuspecting Shareaza users via its update mechanism.

(IIRC the maintainers learned the right lesson from that, and started signing their updates so it can't happen again)

Re: 7-Zip: From Uninitialized Memory to Remote Code Execution

#79

Post by uep »

drzaiusapelord wrote: post #65
jessaustin wrote: post #8

Earlier quoted context omitted.

This includes various anti-virus software. It's fascinating that this category of equipment, which searches for viruses by running untrusted code , is still regularly installed in all corners of valuable networks.

What AVs use this? I keep hearing horrible things about AVs but little proof. I know Tavis from Google finds bugs and AV in rare cases can reduce security, but that's a far cry from them embedding FOSS projects to save time. For AV companies writing a rar parser is a single-day activity, its hard to believe they need this app. The few places I've seen 7z used is in installers where the input is known (installer archi…

Maybe I'm just way overestimating how complex RAR archives are (I admit, I have not looked into this), but I think you're out of your mind if you think that someone could write a parser to analyze RAR archives in a day. That it would be better tested, debugged, and more secure than a tool that has probably seen more widespread use than any single AV.

Re: 7-Zip: From Uninitialized Memory to Remote Code Execution

#80

Post by wyday »

Boulth wrote: post #66
wyday wrote: post #12

Earlier quoted context omitted.

EV Code signing certs get you immediate trust with Smart Screen. Recently discussed over on the bootstrapped forum: http://discuss.bootstrapped.fm/t/code-signing-certificate-re... Regular, non-EV code-signing certs, aren't as useful as they were when Vista / Windows 7 were the main Windows OSes.

I wonder what do you mean by "not useful"? They just have to participate in the reputation system, but that's an issue only when the certificate is young. Here's an excerpt from MSDN: > Detractors may claim that SmartScreen is “forcing” developers to spend money on certificates. It should be stressed that EV code signing certificates are not required to build or maintain reputation with SmartScreen. Files signed with…

I didn’t say “not useful”. Clearly they’re useful. I said non-EV certs “aren’t as useful”. Which is just a fact (as evidenced by the Smart Screen “reputation boost” that EV certs get).

I already read that blog post. I’m person that linked to it in the forum post.

Post reply on HN