News for hackers. Stuff that matters.

A comment on Multiple 7-Zip Vulnerabilities Discovered. Parent comment

Re:Multiple 7-Zip Vulnerabilities Discovered by Splines on Thursday May 12, 2016 @03:31PM (#11686085)
Even if it's in a box, you need to pull the thing you want back out of the box. A malicious file could put a payload into the destination file.
[ Parent | on HN ]
Re:Multiple 7-Zip Vulnerabilities Discovered by tekklloneer on Thursday May 12, 2016 @03:53PM (#11686239)
Yes, by containing the payload and decompressing it.

The difference is that by not sandboxing it, that malicious file could also cause its payload to be executed in the permission scope of the decompressor.

[ Parent | on HN ]
Re:Multiple 7-Zip Vulnerabilities Discovered by Animats on Thursday May 12, 2016 @05:22PM (#11686876)
That's pointless. Putting the malicious file in the archive would accomplish the same result.
[ Parent | on HN ]