landave

PhD in theoretical cryptography. Vulnerability research & information security enthusiast.

[landave @0xlandave]

Excited to share new vulnerability research on Bitdefender's anti-virus engine.

https://t.co/bZrBhLSmJn

[landave @0xlandave]

The new 7-Zip 18.06 fixes some more memory corruptions (among other memory safety issues). They are not extremely critical, because it is presumably (!) not easy to exploit them, but I still recommend updating asap. Not sure if those are worth their own blog post...

[landave @0xlandave]

@matalaz That's a good idea! I've just tested it and this works indeed. I'll add it as an update to the blog post. Thanks!

[x0rz @x0rz]

F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking (RCE as NT AUTHORITY\SYSTEM 😱) https://t.co/pW57mq1l36 #antivirus #vulnerability

[landave @0xlandave]

Excited to share details on a new Remote Code Execution exploit on an anti-virus product. Blog post should be online tomorrow around 8AM EST. Stay tuned.

[landave @0xlandave]

@hanno It is particularly bad for the non-free package p7zip-rar in Debian/Ubuntu, since it is not considered an official part of the distribution and thus not supported by the security team.

[Quequero @quequero]

7-Zip: From Uninitialized Memory to Remote Code Execution: https://t.co/IkgSm0TNQ8

[landave @0xlandave]

@nervoir @steventseeley Good idea! I had the very same thought, and it turned out not to work because the RAR VM is disabled by default in 7-Zip. Concerning ASLR: I agree that it makes it more difficult, but I have a few bypassing ideas. If I find the time, there'll be another blog post on this.

[landave @0xlandave]

@daveaitel Thanks, I really appreciate it :)

[landave @0xlandave]

If you are using 7-Zip, you may want to update to the upcoming 7-Zip 18.05. I'll publish a blog post about a new vulnerability tomorrow.

[landave @0xlandave]

@mkolsek @darrenpauli Just compiled 7-Zip with VS2017 and /DYNAMICBASE. The main binary 7z.dll is 1,569,792 bytes, 9344 bytes (0.595%) of which are used by the relocation table. Enabling stack canaries (/GS) creates a 1,578,496 byte binary (including the relocation table), so another 8704 bytes more.

[x0rz @x0rz]

Bitdefender: Heap Buffer Overflow via 7z LZMA - no direct RCE thanks to ASLR though https://t.co/sXxLwZsyvw #antivirus #vulnerability

[landave @0xlandave]

@Schmiddik4 No, you need to write it manually into your exported identity.ini, replacing the old counter, and then reimport the identity file to TS.

[landave @0xlandave]

@Schmiddik4 I just pushed an update into the github repo. Please try again using the updated version.

[landave @0xlandave]

Verifying myself: I am landave on Keybase.io. H5VF6kg2DkllJ3SSxf-burOkqfXFf11ZJpZi / https://t.co/hDvSxZf2Xp

[The Hacker News @TheHackersNews]

BitDefender: Remote Stack Buffer Overflow via 7z PPMD https://t.co/uDPQYd4MQW #antivirus

[landave @0xlandave]

@Schmiddik4 As described in the readme, the command is just "make all".

[landave @0xlandave]

@Schmiddik4 What error message do you get?

[Ange @angealbertini]

LOL!LOL!LOL!LOL!%PDF-%PDF-
STACK_BUFFER_OVERRUN
https://t.co/iXIRQtuSZi
via @svblxyz