Critical Security Vulnerability in Renowned Compression Manager 7-Zip Allows Execution of Arbitrary Code: Immediate Upgrade Recommended

The security industry recently revealed a critical vulnerability in the well-known compression manager 7-Zip, which could allow attackers to execute arbitrary code. However, there is no need for undue alarm as the vulnerability was reported on June 12, 2024, and the latest version of 7-Zip has already patched this flaw. Therefore, security researchers have now disclosed this vulnerability.

The fixed version was released on June 19, 2024, with the version number 7-Zip v24.07. Subsequent versions, including the latest version at the time of this article's publication, 7-Zip v24.08, are not affected by this vulnerability.

This means that users need to update to at least version v24.07 to ensure the vulnerability cannot be exploited. If you are still using an older version of 7-Zip, please immediately go to the official website to download the latest version and upgrade by overwriting the installation.

Special Note: Most common compression managers integrate the open-source module of 7-Zip, and these managers must also be updated.

Download link: https://www.7-zip.org/

Vulnerability Description:

This vulnerability allows remote attackers to execute arbitrary code on affected versions of 7-Zip. Exploiting this vulnerability requires interaction with the library, but the medium of attack may vary depending on the implementation.

The vulnerability is located in the implementation of 7-Zip's Zstandard decompression, caused by inadequate validation of user-provided data, potentially leading to an integer underflow before writing to memory. Attackers could exploit this vulnerability to execute code within the context of the current process.

Common Exploitation Scenarios:

Attackers could create specific compressed files and induce users to download and decompress them via email or download websites. Upon successful exploitation of this vulnerability, attackers could steal system data or even take over the entire system. Note: This vulnerability cannot remotely execute arbitrary code; it requires user interaction to download and execute the decompression of a specially crafted file.

Vulnerability Information:

• Vulnerability Number: CVE-2024-11477
• CVSS Score: 7.8/10
• Disclosure Timeline: Reported to 7-Zip developers on June 12, 2024, fixed version v24.07 released on June 19, 2024, and coordinated public disclosure starting from October 20, 2024.
• Discoverer: Nicholas Zubrisky from Trend Micro's security research department