4 ms·

Very confusingly written document, but from what I gather there are two vulnerabilities that are problematic for different reasons. 1) a command execution vuln

Very confusingly written document, but from what I gather there are two vulnerabilities that are problematic for different reasons. 1) a command execution vulnerability in 7z. This is problematic because a downloaded 7z file could compromise your machine; 2) a privilege escalation vulnerability in the MS help viewer. This is problematic because it could allow an unprivileged user to gain admin rights. Why the help viewer does anything as NT AUTHORITY\SYSTEM is beyond me. However the post presents them as one single vulnerability?

smileybarry 4y ago
> Why the help viewer does anything as NT AUTHORITY\SYSTEM is beyond me. I don't get it either. From poking around in Process Explorer the help viewer window isn't its own process, it's still part of "7zFM.exe" which is running at medium integrity (not admin). Don't know where the high integrity context is coming from. I wonder if it's silent elevation, in which case just putting UAC on "always ask" is good enough (and what I do anyway).
- divingdragon 4y ago
  The PoC video showed that the current user isn't in the "Administrator" group (though there is another user "zeroday" in there), which makes it look like not a simple UAC bypass. Or perhaps I misunderstood something.
- Someone 4y ago
  Google tells me the help viewer uses IE7 with ActiveX to display help pages (https://www.comparitech.com/blog/information-security/malicious-chm-files/ https://www.comparitech.com/blog/information-security/malici...) Given that, I think this is better removed from any system. If you have to access .chm files, I would first try other tools for displaying html help (https://blog.kowalczyk.info/articles/chm-reader-viewer-for-windows.html https://blog.kowalczyk.info/articles/chm-reader-viewer-for-w... has a list)
  - badsectoracula 4y ago
    Pretty much every other CHM viewer than the original one has multiple issues displaying CHM files properly or at all. Even Free Pascal and Lazarus that use their own tools to both produce and view CHM files (Lazarus has its own cross-platform CHM implementation) have their own CHM files working better with the Microsoft CHM viewer than their own viewer.
bee_rider 4y ago
Phew, I thought I was just bad at parsing this stuff. It seems kind of weird, like on top of the technical details it is describing some still-in-progress argument with the 7zip folks about who is responsible for the bug.
divingdragon 4y ago
I am failing to see (1). It seems when you drop a file into the help viewer window, it is handled by the help viewer itself. You can try it with a random file. It either displays the file inside the help viewer as an HTML file, or a Internet Explorer-like download dialog shows up.
- deleted 4y ago
  [deleted]
DHowett 4y ago
> Why the help viewer does anything as NT AUTHORITY\SYSTEM is beyond me. I don't think it does. The report states that they achieved execution as NT AUTHORITY\SYSTEM using psexec from "SysInternals"; arguably, running something as SYSTEM is psexec's entire purpose, but it does require the installation of a service that runs as SYSTEM and brokers execution.

smileybarry 4y ago

> Why the help viewer does anything as NT AUTHORITY\SYSTEM is beyond me. I don't get it either. From poking around in Process Explorer the help viewer window isn't its own process, it's still part of "7zFM.exe" which is running at medium integrity (not admin). Don't know where the high integrity context is coming from. I wonder if it's silent elevation, in which case just putting UAC on "always ask" is good enough (and what I do anyway).

divingdragon 4y ago
The PoC video showed that the current user isn't in the "Administrator" group (though there is another user "zeroday" in there), which makes it look like not a simple UAC bypass. Or perhaps I misunderstood something.
Someone 4y ago
Google tells me the help viewer uses IE7 with ActiveX to display help pages (https://www.comparitech.com/blog/information-security/malicious-chm-files/ https://www.comparitech.com/blog/information-security/malici...) Given that, I think this is better removed from any system. If you have to access .chm files, I would first try other tools for displaying html help (https://blog.kowalczyk.info/articles/chm-reader-viewer-for-windows.html https://blog.kowalczyk.info/articles/chm-reader-viewer-for-w... has a list)
- badsectoracula 4y ago
  Pretty much every other CHM viewer than the original one has multiple issues displaying CHM files properly or at all. Even Free Pascal and Lazarus that use their own tools to both produce and view CHM files (Lazarus has its own cross-platform CHM implementation) have their own CHM files working better with the Microsoft CHM viewer than their own viewer.

bee_rider 4y ago

Phew, I thought I was just bad at parsing this stuff. It seems kind of weird, like on top of the technical details it is describing some still-in-progress argument with the 7zip folks about who is responsible for the bug.

divingdragon 4y ago

I am failing to see (1). It seems when you drop a file into the help viewer window, it is handled by the help viewer itself. You can try it with a random file. It either displays the file inside the help viewer as an HTML file, or a Internet Explorer-like download dialog shows up.

deleted 4y ago
[deleted]

DHowett 4y ago

> Why the help viewer does anything as NT AUTHORITY\SYSTEM is beyond me. I don't think it does. The report states that they achieved execution as NT AUTHORITY\SYSTEM using psexec from "SysInternals"; arguably, running something as SYSTEM is psexec's entire purpose, but it does require the installation of a service that runs as SYSTEM and brokers execution.