3 ms·
The vulnerability isn't to do with what file system you're running, it's to do with using 7-zip to view the contents of archives in those file formats. Which me
by laumars 11y ago
The vulnerability isn't to do with what file system you're running, it's to do with using 7-zip to view the contents of archives in those file formats. Which means if someone wanted to view ala DVD ".iso" which used the UDF specification, then they could be vulnerable if they use 7-zip.
I remember it used to be common place to open .iso files with WinRar back in the 90s. I wouldn't be surprised if a sizeable number of people now use 7-zip similarly
- paulfr 11y agoI just did some testing and it's even worse than that: 7-zip completely ignores the file extension and snoops the file format based on the file contents only. So simply opening a malicious ".zip" file on Windows could trigger the HFS+ vulnerability. Using 7-zip to open any file means you have a HUGE attack surface. EDIT: One simple way to mitigate this issue would be to just throw a confirmation prompt if the file extension matches a known format but 7-zip is about to run a decoder for a different format.
- colejohnson66 11y agoIIRC, 7-zip does tell you if the actual format is different. At least it does when I extract some DMGs; it tells me it's actually an HFS "file".
- paulfr 11y agoNot on Windows, at least. The properties dialog can tell you it uses HFS+ if you ask for it, but it's too late because the HFS+ code has already been executed.
- colejohnson66 11y agoI meant when right clicking the archive am choosing "Extract to..." or something using Explorer's context menu.
- paulfr 11y agoInteresting, it does display a warning in this case! But it doesn't interrupt extraction so if it's a malicious file the code will still execute.