[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <aJxWPAv5ew3BCm+O@adhil>
Date: Wed, 13 Aug 2025 11:09:16 +0200
From: Jens-Wolfhard Schicke-Uffmann <drahflow@....de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2025-55188: 7-Zip: Arbitrary file write on
extraction, may lead to code execution
On Sun, Aug 10, 2025 at 05:04:24PM -0700, lunbun wrote:
> If a symlink targets a nonexistent directory, the write will fail. 7-Zip by
> default will print an error message, like:
> ```
> ERROR: Cannot open output file : errno=2 : No such file or directory : ./
> malicious_link/file.txt
> ```
>
> This applies similarly to other filesystem errors, like insufficient
> permissions or unwritable directory.
>
> However, 7-Zip by default continues with extraction regardless of the error,
> which is why an attacker can use this "shotgun" strategy. These errors, though,
> would hopefully help notify the user that something suspicious is happening.
Never forget terminal escape codes. At least the 7-Zip my debian
has dumps the raw filename in those error messages. This allows an attacker
to clean the specific error lines after they have been output (with
another, later filename containing the required escapes).
With some fantasy, it might also be possible to massage the overwrite
prompts (they're also unescaped) into suggesting to choose "(A)lways",
e.g. by good cursor movement and setting a scroll region far above for
the real prompt.
Regards,
Drahflow
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
