Guru3D.com
  • HOME
  • NEWS
    • Channels
    • Archive
  • DOWNLOADS
    • New Downloads
    • Categories
    • Archive
  • GAME REVIEWS
  • ARTICLES
    • Rig of the Month
    • Join ROTM
    • PC Buyers Guide
    • Guru3D VGA Charts
    • Editorials
    • Dated content
  • HARDWARE REVIEWS
    • Videocards
    • Processors
    • Audio
    • Motherboards
    • Memory and Flash
    • SSD Storage
    • Chassis
    • Media Players
    • Power Supply
    • Laptop and Mobile
    • Smartphone
    • Networking
    • Keyboard Mouse
    • Cooling
    • Search articles
    • Knowledgebase
    • More Categories
  • FORUMS
  • NEWSLETTER
  • CONTACT

New Reviews
EVGA GeForce RTX 3070 FTW3 Ultra review
Corsair 5000D PC Chassis Review
NZXT Kraken X63 RGB Review
ASUS Radeon RX 6900 XT STRIX OC LC Review
TerraMaster F5-221 NAS Review
MSI Radeon RX 6800 XT Gaming X TRIO Review
Sapphire Radeon RX 6800 NITRO+ review
Corsair HS70 Bluetooth Headset Review
MSI MEG X570 Unify review
Scythe Ninja 5 air cooler review

New Downloads
3DMark Download v2.16.7117 + Time Spy
Prime95 download version 30.4 build 6
Crystal DiskMark 8.0.1 Download
Corsair Utility Engine Download (iCUE) Download v3.37.140
ReShade download v4.9.1
GeForce 461.09 WHQL driver download
Intel HD graphics Driver Download Version: DCH 27.20.100.9126
HWiNFO Download v6.41–4345 Beta
MSI Afterburner 4.6.3 Beta 4 Download
BaseMark GPU Benchmark v1.2.3 download


New Forum Topics
ASUS ROG-STRIX-LC-RX6800XT-O16G-GAMING Instant crash under load CD Projekt apologizes for the release of Cyberpunk 2077 and shows 2021 roadmap New ASUS Prime Z390-A freezes on fresh Win10 install AMD Releases AGESA 1.1.9.0 Firmware Updates, Improves FCLK OC Stability The AMD Ryzen All In One Tread /Overclocking/Memory Speeds & Timings/Tweaking/Cooling Part 2 Stopped booting Will the 1st driver of 2021 be more then a common update? Grab for free: Star Wars Battlefront II: Celebration Edition Best Driver for GTX 980 Best Driver for 1050 Ti




Guru3D.com » News » Big Vulnerability hits 7-Zip file archiver - gets patched - Download v18.05

Big Vulnerability hits 7-Zip file archiver - gets patched - Download v18.05

by Hilbert Hagedoorn on: 05/03/2018 07:00 AM | source: | 16 comment(s)
Big Vulnerability hits 7-Zip file archiver - gets patched - Download v18.05

If you use, you can and should download v18.05 of the popular 7-Zip file archiver. The free to use WinZip replacement has a very critical vulnerability for which all it needed was a specially prepped RAR file. 

This has been addressed with the release of has been fixed with v18.05, I am highlighting this new v18.05 release this much as this is a pretty bad one as it allows remote execution, based on just a RAR file. The security researcher (landave.io) who discovered the vulnerability informed the developer of 7-Zip on the 6th of March this year. it has patched with the release of 7-Zip 18.05, which not only fixes the vulnerability but also adds ASLR security measures.

7-Zip is one of the most popular archivers available on the web, downloaded nearly 450 million times from Sourceforge alone. All users of 7-Zip are advised to update the software to the latest version, I've made a local mirror on Guru3D, which can be downloaded from here.
 

  > Download

 



Big Vulnerability hits 7-Zip file archiver - gets patched - Download v18.05




« Backblaze Hard Drive Stats for Q1 2018 Have Been published - 4TB HGST HDDs Very Reliable · Big Vulnerability hits 7-Zip file archiver - gets patched - Download v18.05 · Gigabyte may ship less than 10 million motherboards in 2018 »

4 pages 1 2 3 4


BlueRay
Senior Member



Posts: 276
Joined: 2015-11-18

#5543361 Posted on: 05/03/2018 07:07 AM
Yet it doesn't have an auto update or an update notifier. And this is why it's bad and dangerous when applications can't auto update.

Kaarme
Senior Member



Posts: 2203
Joined: 2013-03-10

#5543366 Posted on: 05/03/2018 07:22 AM
Thanks for the heads-up! I doubt I'd have noticed a thing like this otherwise.

386SX
Senior Member



Posts: 1044
Joined: 2017-06-26

#5543370 Posted on: 05/03/2018 07:37 AM
@BlueRay: Please keep in mind even update servers may infect themselfes. This has been done in the past multiple times. The last time I know was some kind of banking software which downloaded an infected update (crypto trojan) from its compromised update servers. Because autoupdates were ON by default, half its clients were infected.

On the one hand may be wise to let programs autoupdate themselfes if you trust them >>and the whole chain<<.
On the other hand it may be even better to disable autoupdates and do the patching the manual way on critical infrastructure. Remember the time when Windows 10 updates broke some computers? (Isn't it still a thing today?)
My grandma would be better off with autoupdates which >>I<< enable, for the most important programs.
Personally I feel safer with a weekly "patchday", where I download (or check for) program updates. A big PRO is you do not have to have dozens of programs running in the background, checking for updates every few minutes / hours. Saves bandwidth, ressources and therefore energy (a small bit). "Green IT by disabling autoupdaters." ;-)

I used 7-zip for many many years and still use it today. It offers all the formats you want your archive program to support. RAR, ZIP, 7Z, WIM, ISO and a lot more is supported. That is what I care of the most, after the fact it's free without any hidden fees and does not come with any spyware, adware, other crap bundled. ("Hi FlashPlayer!").

I do not care about the security issue found here. Honestly: Every program has these. But after escalating the issue to the publisher you see if you may trust them in the future. If a bug does not get patched, this is far worse from my point of view than a program who has thousands of bugs but they get fixed in week 1. The publishers of 7-zip did their job right and fixed the bug. They communicated this to the public the right way (AFTER the patch is available but still in a reasonable "short" period of time), so no bad feelings about this.

fantaskarsef
Senior Member



Posts: 12047
Joined: 2014-07-21

#5543371 Posted on: 05/03/2018 07:38 AM
IT department uses 7zip, no update queued as of right now.
IT department releases win10 on newer (Dell) laptops, and I'm not sure they know what to deactivate and what not.

As you might think, my trust in my company's IT department is not that big :D

BlueRay
Senior Member



Posts: 276
Joined: 2015-11-18

#5543383 Posted on: 05/03/2018 08:20 AM
@386SX I understand that but a notification prompting user to go to the website and download the new version is the bare minimum for security. It is the most popular zip tool yet it expects users to read tech blogs to find out their version is not secure. This is bad.

4 pages 1 2 3 4


Post New Comment
Click here to post a comment for this news story on the message forum.


Guru3D.com © 2021