7-Zip: From Uninitialized Memory to Remote Code Execution
There were some misunderstandings that I want to clear up (maybe I will add them in an update to the blog post):<p>1. Some people mentioned that this would &quot;only affect RAR files&quot; and it would be safe to extract 7z files with 7-Zip prior to version 18.05. This is wrong, because 7-Zip detects the file type from the magic numbers at the beginning of the file. So the exploit can be renamed to &#x27;exploit.7z&#x27; and it works just as well.<p>On &#x2F;r&#x2F;sysadmin, someone even mentioned that a temporary solution might be to block RAR files. By the same argument, this is unlikely to be effective.<p>2. Almost all versions prior to 18.05 are affected. I manually checked version 15.05 and 17.01, and they are definitely affected.<p>3. Not only 7-Zip itself is affected, but essentially all software that uses 7z.dll as library to extract files. This includes various anti-virus software. However, exploitation may be more difficult (though not impossible) if ASLR&amp;DEP is properly enabled (on all modules).