News for hackers. Stuff that matters.

A comment on Multiple 7-Zip Vulnerabilities Discovered. Parent comment

Re:Multiple 7-Zip Vulnerabilities Discovered by laumars on Thursday May 12, 2016 @02:48PM (#11685787)
The vulnerability isn't to do with what file system you're running, it's to do with using 7-zip to view the contents of archives in those file formats. Which means if someone wanted to view ala DVD ".iso" which used the UDF specification, then they could be vulnerable if they use 7-zip.

I remember it used to be common place to open .iso files with WinRar back in the 90s. I wouldn't be surprised if a sizeable number of people now use 7-zip similarly

[ Parent | on HN ]
Re:Multiple 7-Zip Vulnerabilities Discovered by paulfr on Thursday May 12, 2016 @03:03PM (#11685892)
I just did some testing and it's even worse than that: 7-zip completely ignores the file extension and snoops the file format based on the file contents only.

So simply opening a malicious ".zip" file on Windows could trigger the HFS+ vulnerability. Using 7-zip to open any file means you have a HUGE attack surface.

EDIT: One simple way to mitigate this issue would be to just throw a confirmation prompt if the file extension matches a known format but 7-zip is about to run a decoder for a different format.

[ Parent | on HN ]
Re:Multiple 7-Zip Vulnerabilities Discovered by colejohnson66 on Thursday May 12, 2016 @03:35PM (#11686101)
IIRC, 7-zip does tell you if the actual format is different. At least it does when I extract some DMGs; it tells me it's actually an HFS "file".
[ Parent | on HN ]
Re:Multiple 7-Zip Vulnerabilities Discovered by paulfr on Thursday May 12, 2016 @04:21PM (#11686458)
Not on Windows, at least. The properties dialog can tell you it uses HFS+ if you ask for it, but it's too late because the HFS+ code has already been executed.
[ Parent | on HN ]
Re:Multiple 7-Zip Vulnerabilities Discovered by colejohnson66 on Thursday May 12, 2016 @06:13PM (#11687224)
I meant when right clicking the archive am choosing "Extract to..." or something using Explorer's context menu.
[ Parent | on HN ]
Re:Multiple 7-Zip Vulnerabilities Discovered by paulfr on Thursday May 12, 2016 @06:33PM (#11687341)
Interesting, it does display a warning in this case! But it doesn't interrupt extraction so if it's a malicious file the code will still execute.
[ Parent | on HN ]