Slashdot Mirror
Dangerous 7-Zip Vulnerabilities Flow To Top Security, Software Tools (theregister.co.uk)
mask.of.sanity quotes a report from The Register: Some of the world's biggest security and software vendors will be rushing to patch holes in implementations of the popular 7-Zip compression tool to stop attackers gaining full control of customer machines. Marcin Noga, Cisco security researcher, found and reported the holes to the platform, which could allow attackers to compromise updated machines, giving attackers the same access rights as logged-in users. FireEye and MalwareBytes are two of many products that use 7-Zip. "An out-of-bounds read vulnerability exists in the way 7-Zip handles Universal Disk Format files ... [which] can be triggered by any entry that contains a malformed Long Allocation Descriptor," Colleague of The Register Jaeson Schultz said. The flaws were fixed in 7-Zip 16.00, which was released Tuesday.
"catched it"? Your spell checker should have caught that one.
I'm glad to see its finally out of beta.
Minimum threshold fixed. Thanks!
I think you meant language debugger.
Or Parsey McParseface
You mean... it's killed children!?
This is why millions of eyes on code is a solid requirement for any software. It IS the undisputed truth.
Al least in any sane system, and Windows has started, a few decades late, to use sound OS design practices. So no, not "full control".
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Derpitydoo open blahbityda source bliperado many hurrdurr eyes!
Why did the version numbering jump so much? It went from 9.38 to 15.05 in five months with no releases between those two.
"Anytime the vulnerable code is being run by any sort of privileged account, an attacker can exploit the vulnerability and execute code under those same permissions," ref
Why the hell did i have to reboot to install a opensource compression package? Never done that before...
Except even very skilled and organized coders makes bugs, even if less frequently, which means security bugs sometimes come in groups and sometimes not...
So I'm safe.
Dangerous 7-Zip Vulnerabilities Flow To Top Security, Software Tools
What?
systemd is Roko's Basilisk.
So, when installing a new machine, how do you choose to open zip files? Winzip has that irritating registration screen, Windows native zip opening lacks features, 7zip sucks too, so what do people use these days that's free and downloadable?
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
People do this because C and C++ are faster than the new ones.
> a programming language so crude it does not even have a concept of an array, and hence bounds checking
Obviously, http://en.cppreference.com/w/c... doesn't exist in your world.
The astonishing thing is that after 3 decades of stack-crashing causing more security bugs than any other type - there still isn't a native array/hash/list type added to C.
One can sanely argue that there are genuine cases where C's freedom to do almost anything is both needed and wanted - but how does that preclude giving sane, one-place-fixable standard data types for common tasks which you can deviate from only when you do, in fact, have to ?
Sure there are implementations of such in some libraries - but the moment you go there your programs portability and shippability is suddenly dependent on those of the library. This is the kind of functionality that ought to have been in ANSI-C decades ago so you could use it, and compile with any standards compliant compiler on any platform without fear.
Unicode killed the ASCII-art *
He talked about array, not vector.
I am TheRaven on Soylent News
The astonishing thing is that after 3 decades of stack-crashing causing more security bugs than any other type - there still isn't a native array/hash/list type added to C.
There is, but the resulting language is called C++. The type system of C doesn't allow you to have container-of-X, where X is some other type, constructs without resorting to macros. A lot of systems (including Windows NT and Linux) use derivatives of the 4BSD headers for this, but they use a container-of pattern that involves casting from a pointer to member to a pointer to the outer structure in a way that depends on explicit casts and makes it easy to accidentally violate type safety.
I am TheRaven on Soylent News
> C blah blan mumble 2016 mumble
And what are you proposing? PHP?
(those "if this were written in $MY_FAVE_LANG this wouldn't have happened" really miff me. Even worse those who are too coward not to name $MY_FAVE_LANG).
Pro tip: improve the craftspeople, then the tools.
Yes, everything should be done in JavaScript or Flash.
From 1992 onward C-2 Orange Book security design in Windows NT based OS (NT/2000/XP/7) was HUGE leap over Win9x & certainly Win3.x + below before it (in both stability & security).
They ALL have Access Control Lists + Group Policies, as far as security goes, on NTFS filesystems & registry level access by user name or group as well!
APK
P.S.=> Unless I misunderstood you, I have to ask you - have you actually USED any/all of those versions of Windows before that you made the statement you did? apk
Can someone please tell me what this means to me?
I do not work in IT, I work in engineering. Our IT department keeps themselves clueless about CAD & CAD data management & somehow, mainly by default, I am the admin (in my spare time HA! what exactly is spare time?!). I've been using & deploying 7zip on all the clients I install our CAD platforms on.
Are all these machines at risk? Am I going to get an email from that IT guy yet again?
SLOWER TRAFFIC KEEP RIGHT
Ok, so I read the article and my collegues and I use 7-zip quite a bit - so I am trying to figure out if the vulnerability was addressed in the latest release
I see the article was posted on the 11th, and 7-zip's latest builds seems to be v 16.0 which was published on 5/10 ... but looking at the 7-zip fix history:
http://www.7-zip.org/history.t...
All I see is that "some bugs were fixed" - this does not fill me with confidence.
So, I'm just trying to decide if the may 10 update and May 11 release is enough circumstantial evidence to say "ahh v16 fixes this so just update and we're good (assuming we don't have any other tools that bake in vulnerable past 7-zip sdk builds)
My guess is that updating to 16.0 will likely fix this in my directly installed copy of 7-zip.... though I don't like going on hope and circumstantial evidence.
The Digital Sorceress
What program has ever been 100% free of security holes? Have you ever looked at metasploit and seen how many vulnerabilities are there alone?
Wrong. Dead wrong. This is the usual brogrammer attitude. I've been doing this stuff for 30 years, and I have heard a lot of it.
It is extremely difficult and time consuming for humans to program safely in C. Human brains do not work that way. Yes, that includes your brain. Yes, I know you think you're an exception. You are not. And out here in the real world, your management is not going to give you the time to do the extremely tedious checking necessary to avoid running off the ends of buffers in a language where every array reference is expressed in terms of arbitrary un-bounds-checked pointer arithmetic and pointer type casts are a major idiom.
What would be better? Almost anything. 1970s languages like Ada, if you turn on bounds checking. Managed languages like Java. Languages with halfway decent type systems like Haskell or even OCaml or Rust (just stay away from unsafe extensions). Even super dangerous hyper-dynamic toy scripting languages like Python or JavaScript are safer than C.
You can go ahead and write your 10 line inner loop in C, which will get you 95 percent of the performance you're about to complain about. You should not be writing your file parser in it.
JAVA is the only answer!!!! all hail the Oracle.
I'm pretty sure that the BSD that Bill Joy ran on his VAXes could not nspawn a container, so I might interject that the Linux privilege system has changed slightly.
Now, if you don't carefully populate your container, you can easily cause more security problems than you solve.
Spoken like someone with no understanding of the limitations of the hardware their code is running on.
Conditional branching is generally by *far* the slowest thing you can do on a modern CPU, since it can completely stall out the instruction pipeline, especially if the next instruction can't proceed safely until the conditional is resolved (like, say, "do not access the indexed memory location until we've confirmed the index is valid). An Intel Core i5 has a pipeline depth of 14, so while most common instructions complete at a rate of 1 per tick, a conditional jump can stall things for up to 14 ticks. A good compiler can (often) help immensely by reorganizing instructions so that the the conditional result isn't immediately critical, but if you're doing any sort of serious array processing, like say matrix multiplication, bounds-checking is probably going to be responsible for the vast majority of the total CPU time used.
Of course there's lots of very common situations where actually traversing the array is only a tiny percentage of the work done on each element, and the performance penalty is thus tiny enough to be well worth the safety gains. Which is why C++ includes container classes that *do* offer bounds checking - and those should be used wherever appropriate, as they also offer lots of other conveniences. But one of C and C++s great claims to fame, one of the reasons they are still some of the most widely used languages on the planet, is that they combine the performance of hand-tuned assembly with the convenience of a high-level language. And its primitive data types must necessarily reflect the compromises required for that to be attainable.
Bottom line: if you don't have the skill and/or discipline necessary to safely use the footgun, DON'T TOUCH THE FOOTGUN. The C++ standard library makes it relatively easy to avoid the most dangerous pitfalls, with performance penalties no worse (and often much better) than languages where such constructs are part of the language itself. Even skilled professionals should probably steer clear of naked arrays and pointer manipulation unless they have a reason to do so. It's perhaps disappointing though that you typically have to explicitly invoke bounds checking with the .at(i) function while the more concise [i] notation bypasses it.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
7z is a software used to manipulate archives in numerous format (including a few obscure format - one of the most compatible on the market).
Lots of security software like antivirus need to be able to process archives (e.g.: an antivirus needs to scan all the files packaged into a ZIP archive).
Some of these security software use 7z as an archive engine.
7z has a vulnerability when unpacking a specially crafted archive.
This flaw will extend to security sofware that rely on 7z as a component to help them handle archives.
Hence "Dangerous 7-Zip Vulnerabilities Flow To Top Security, Software Tools"
By sending an e-mail with a specially crafted ZIP file attachment, you can b0rk the mail server using an exploit that affects the antivirus in charge of scanning incomming attachments, because that antivirus relied on 7z.
That means
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Rust. Duh.