Big Vulnerability hits 7-Zip file archiver - gets patched - Download v18.05

#5543361 Posted on: 05/03/2018 08:07 AM

---

Yet it doesn't have an auto update or an update notifier. And this is why it's bad and dangerous when applications can't auto update.

#5543366 Posted on: 05/03/2018 08:22 AM

---

Thanks for the heads-up! I doubt I'd have noticed a thing like this otherwise.

#5543370 Posted on: 05/03/2018 08:37 AM

---

@BlueRay: Please keep in mind even update servers may infect themselfes. This has been done in the past multiple times. The last time I know was some kind of banking software which downloaded an infected update (crypto trojan) from its compromised update servers. Because autoupdates were ON by default, half its clients were infected.

On the one hand may be wise to let programs autoupdate themselfes if you trust them >>and the whole chain<<.
On the other hand it may be even better to disable autoupdates and do the patching the manual way on critical infrastructure. Remember the time when Windows 10 updates broke some computers? (Isn't it still a thing today?)
My grandma would be better off with autoupdates which >>I<< enable, for the most important programs.
Personally I feel safer with a weekly "patchday", where I download (or check for) program updates. A big PRO is you do not have to have dozens of programs running in the background, checking for updates every few minutes / hours. Saves bandwidth, ressources and therefore energy (a small bit). "Green IT by disabling autoupdaters." ;-)

I used 7-zip for many many years and still use it today. It offers all the formats you want your archive program to support. RAR, ZIP, 7Z, WIM, ISO and a lot more is supported. That is what I care of the most, after the fact it's free without any hidden fees and does not come with any spyware, adware, other crap bundled. ("Hi FlashPlayer!").

I do not care about the security issue found here. Honestly: Every program has these. But after escalating the issue to the publisher you see if you may trust them in the future. If a bug does not get patched, this is far worse from my point of view than a program who has thousands of bugs but they get fixed in week 1. The publishers of 7-zip did their job right and fixed the bug. They communicated this to the public the right way (AFTER the patch is available but still in a reasonable "short" period of time), so no bad feelings about this.

#5543371 Posted on: 05/03/2018 08:38 AM

---

IT department uses 7zip, no update queued as of right now.
IT department releases win10 on newer (Dell) laptops, and I'm not sure they know what to deactivate and what not.

As you might think, my trust in my company's IT department is not that big

#5543383 Posted on: 05/03/2018 09:20 AM

---

@386SX I understand that but a notification prompting user to go to the website and download the new version is the bare minimum for security. It is the most popular zip tool yet it expects users to read tech blogs to find out their version is not secure. This is bad.