Security devices affected by 7-Zip flaws

[Whi5t1eR]

Researchers have uncovered two vulnerabilities in 7-Zip that leave various security devices and anti-virus products vulnerable to attack. 7-Zip is an open-source Windows utility that allows a user to manipulate archives for extremely high compression. The application provides support for large files and features optional AES-256 encryption, though users can employ "any compression, conversion or encryption method." The file archiver is also free, which has earned it much attention on both sides of the information security divide. On the one hand, multiple vendors including FireEye, Malwarebytes, and Comodo have integrated 7-Zip's libraries and components into their anti-virus products, as reported by Network World. On the other hand, attackers have modified Nemucod, which was once just a Trojan downloader disguised as a ZIP file attachment, and made into a fully functional ransomware variant that uses 7-Zip's software to encrypt victims' files. But users be warned. Cisco Talos recently discovered multiple vulnerabilities in 7-Zip that are more serious than regular security flaws. As explained in a blog post by Marcin Noga and Jaeson Schultz, two members of the Cisco Talos Security Intelligence & Research Group. Cisco Talos has identified two flaws in particular. The first (CVE-2016-2335) is an out-of-bounds read vulnerability that exists in the way 7-Zip handles Universal Disk Format (UDF) files. An attacker could potentially exploit this vulnerability to achieve arbitrary code execution. The second flaw (CVE-2016-2334) is a heap overflow vulnerability that exists in the Archive::NHfs::CHandler::ExtractZlibFile method functionality of 7-Zip. The flaw pertains to how compressed files that exceed a certain size are stored in a resource fork and split into blocks. A failure to check into those block sizes can result in a malformed block size that will cause a buffer overflow and heap corruption. Update all vulnerable version of 7-Zip to the latest revision, version 16.02 which is available from NSane as soon as possible.

[Reefa]

Old News Wrong Forums and Already Posted Here   Thread Closed...