landave

5 ms·

1.
Bitdefender: UPX Unpacking Featuring Ten Memory Corruptions(landave.io)
1 points by landave 6y ago|0 comments
2.
Bitdefender: UPX Unpacking Featuring Ten Memory Corruptions(landave.io)
4 points by landave 6y ago|0 comments
3.
by landave 8y ago
Wow. It appears that movaxbx.ru copied multiple of my blog posts as well[1][2][3][4]. I wonder how hard it would be to take legal action (in particular to stop them from doing this altogether, as opposed to just taking down a single article
4.
by landave 8y ago
LGPL or not, if I remember correctly, F-Secure does not enforce a valid signature of the 7-Zip library, so you can replace it yourself. Don't quote me on this though. However, F-Secure applies several patches to harden 7-Zip and to fix
5.
by landave 8y ago
Why do you think so? It seems they have updated to 7-Zip 18.05 on May 11, 2018: https://forums.malwarebytes.com/topic/228610-vulnerability-i...
6.
F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking(landave.io)
105 points by landave 8y ago|28 comments
7.
by landave 8y ago
I think this is correct. Since _solidAllowed is set to false at the beginning of Code(), it will remain false if an exception occurs in the middle of decoding (CVE-2018-5996). This will enforce PpmError being set to true for the next item,
8.
by landave 8y ago
> does say VS2017 produce a smaller executable file, or a faster executable? If I recall correctly, Igor once said that he tested the new VS compiler and it produced neither smaller nor faster executables. I believe there was almost no d
9.
by landave 8y ago
Okay, so these packages come with more mitigations than 7-Zip on Windows. However, looking at the source code, I am pretty sure they are affected by the same bug.
10.
by landave 8y ago
That's right, they patched CVE-2017-17969, which affected ZIP decompression. Interestingly, I believe they didn't patch CVE-2018-5996 (affecting RAR), which I published [0] on January 23 together with CVE-2017-17969. [0]: https:&
11.
by landave 8y ago
You missed my point. It is trivial to find out what the magic number is. What is more important though: How exactly is the magic number matched? From what you have written, one might be tempted to simply check whether a file begins with thi
12.
by landave 8y ago
Just looked at both the packages source, and it looks like they are affected. At least all the vulnerable code is in the source package.
13.
by landave 8y ago
Of course, but I would still strongly advise against this. If you really cannot avoid implementing something like this, you should inspect the 7-Zip code in order to be 100% sure that the magic number detection in your filter is identical (
14.
by landave 8y ago
HE-ASLR I am discussing with him right now, and I think we will get this. But honestly, I don't think we will ever see a 7-Zip with /GS or CFG. Not only would this cost about 1% in binary size, it would cost an additional 1% in ru
15.
by landave 8y ago
Note that the standard 'p7zip' package from Debian/Ubuntu doesn't support RAR. However, they have an additional package 'p7zip-full' or 'p7zip-rar' for RAR support. I didn't check explicitly, but
16.
by landave 8y ago
DEP was previously disabled because Igor used to compile 7-Zip with VC6, which doesn't support the /NXCOMPAT flag. I convinced him back in January to enable it for 7-Zip 18.01. Note, however, that 64-bit versions of Windows enforc
17.
by landave 8y ago
There were some misunderstandings that I want to clear up (maybe I will add them in an update to the blog post): 1. Some people mentioned that this would "only affect RAR files" and it would be safe to extract 7z files with 7-Zip
18.
7-Zip: From Uninitialized Memory to Remote Code Execution(landave.io)
342 points by landave 8y ago|114 comments
19.
7-Zip: From Uninitialized Memory to Remote Code Execution(landave.io)
3 points by landave 8y ago|0 comments
20.
by landave 9y ago
I assume you mean a performance comparison? The runtime performance cost of ASLR on Windows is zero once a binary has been loaded, since the code is relocated at load time. Stack canaries might cause a slight performance hit, but it is usua
21.
by landave 9y ago
So I just tried to compile 7-Zip with VS2017 and /DYNAMICBASE. The main binary 7z.dll is 1,569,792 bytes in total, 9344 bytes (0.595%) of which are used by the relocation table. Enabling stack canaries (/GS) gives me a 1,578,496 b
22.
by landave 9y ago
What do you mean exactly by "these things"? It may be that the blog post is difficult to understand simply because I have written it poorly...
23.
by landave 9y ago
Thanks for pointing this out. I just fixed it.
24.
by landave 9y ago
Yes, 18.00 beta is the patched version. The current release (non-beta) version is not patched yet. Moreover, the POSIX port of p7zip is not patched yet at all.
25.
by landave 9y ago
The RAR PPMd bug can only be triggered if many conditions are satisfied. For example, the RAR archive needs to be mostly correctly structured, and needs to have at least two items that are compressed with the right flags (e.g., RAR version
26.
by landave 9y ago
You are completely right with the first comment. The antivirus product itself reuses parts of 7-Zip and is vulnerable itself. I mentioned this mainly because I did not analyze the original 7-Zip software, but only discovered that it was aff
27.
7-Zip: Multiple Memory Corruptions via RAR and ZIP(landave.io)
252 points by landave 9y ago|101 comments
28.
7-Zip: Multiple Memory Corruptions via RAR and ZIP(landave.io)
5 points by landave 9y ago|0 comments
29.
Palo Alto Networks White Paper: Protect Yourself from Antivirus [pdf](paloaltonetworks.com)
1 points by landave 9y ago|0 comments
30.
by landave 9y ago
I couldn't agree more, and I've always been a strong advocate of learning things bottom up, as opposed to top down. However, it always amazes me how powerful abstractions such as high-level languages are. In particular, it allows

More ›