3 ms·
Great, a new attack vector. Don't get me wrong, I love that they add support for more open source formats, but decompressors (especially written in C) are one
by lostmsu 3y ago
Great, a new attack vector.
Don't get me wrong, I love that they add support for more open source formats, but decompressors (especially written in C) are one of the most common sources of bugs basically everywhere. I wish they would sandbox it, but they probably won't.
- deleted 3y ago[deleted]
- jsheard 3y agoHaving the decompressor updated automatically by Windows Update is a significant step up from the current status quo of installing WinRAR or 7zip once and then usually never updating it for years because it has to be done manually. Microsoft will probably have more diligence in hardening the binaries than 7zip too, which resisted enabling basic exploit mitigations like DEP and ASLR until 2018 and still doesn't enable the more advanced MSVC mitigations as far as I'm aware. There's no excuse for that in an application that's expected to handle untrusted files.
- tssva 3y agoThis is implemented via libarchive which has actually shipped along with bsdtar for years now in Windows. They are just adding Windows explorer support for them.
- MikusR 3y agoCovered by Microsoft Bug Bounty Program