{"id":25703,"date":"2025-01-22T06:10:07","date_gmt":"2025-01-22T14:10:07","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2025\/01\/22\/news-19426\/"},"modified":"2025-01-22T06:10:07","modified_gmt":"2025-01-22T14:10:07","slug":"news-19426","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2025\/01\/22\/news-19426\/","title":{"rendered":"7-Zip bug could allow a bypass of a Windows security feature. Update now"},"content":{"rendered":"\n

A patch is available for a vulnerability in 7-Zip that could have allowed attackers to bypass the Mark-of-the-Web (MotW) security feature in Windows.<\/p>\n

The MotW is an attribute added to files by Windows when they have been sourced from an untrusted location, like the internet or a restricted zone. The MotW is what triggers warnings that opening or running such files could lead to potentially dangerous behavior, including installing malware on their devices. 7-Zip added support for MotW<\/a> in June 2022. <\/p>\n

The MotW also makes sure that Office documents that are marked with the MotW will be opened in Protected View, which automatically enables read-only mode and means that all macros will be disabled until the user allows them.<\/p>\n

\"Security
MotW security warning in file properties<\/figcaption><\/figure>\n

For years, attackers were able to bypass the MotW by putting their malicious files in archives. This worked because the MotW is in fact another file that is attached to the main file as an Alternate Data Stream (ADS)<\/a>, and over the years we have seen many vulnerabilities in archivers where the ADS didn’t pass on the individual files when the archive was decompressed.<\/p>\n

The same is true this time. Only the attacker will have to prepare an especially crafted nested archive. A nested archive means there is an open archive inside another open archive. Exploitation of the vulnerability also requires user interaction, meaning the target will have to visit a malicious page or open a malicious file.<\/p>\n

If you’re a Windows user, check whether you are using version 7-Zip 24.09<\/a> or later. If you’re not, then they’ll need to update.<\/p>\n

7-Zip does not have an auto-update function, so you will have to download the version that is suitable for your system from the 7-Zip downloads page<\/a>.<\/p>\n

Other security measures<\/h2>\n

There are some general safety tips to keep in mind when you\u2019re handling archived files on a regular basis:<\/p>\n