{"id":433606,"date":"2022-04-18T20:38:11","date_gmt":"2022-04-18T17:38:11","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/new-7-zip-archiver-hack-reveals-a-long-ignored-windows-vulnerability-review-geek\/"},"modified":"2022-04-18T20:38:11","modified_gmt":"2022-04-18T17:38:11","slug":"new-7-zip-archiver-hack-reveals-a-long-ignored-windows-vulnerability-review-geek","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/new-7-zip-archiver-hack-reveals-a-long-ignored-windows-vulnerability-review-geek\/","title":{"rendered":"#New 7-Zip Archiver Hack Reveals a Long Ignored Windows Vulnerability \u2013 Review Geek"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6af24ad9355f6\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6af24ad9355f6\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-1'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/new-7-zip-archiver-hack-reveals-a-long-ignored-windows-vulnerability-review-geek\/#%E2%80%9CNew_7-Zip_Archiver_Hack_Reveals_a_Long_Ignored_Windows_Vulnerability_%E2%80%93_Review_Geek%E2%80%9D\" >&#8220;New 7-Zip Archiver Hack Reveals a Long Ignored Windows Vulnerability \u2013 Review Geek&#8221;<\/a><ul class='ez-toc-list-level-2' ><li class='ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/new-7-zip-archiver-hack-reveals-a-long-ignored-windows-vulnerability-review-geek\/#How_Does_the_Exploit_Work\" >How Does the Exploit Work?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/new-7-zip-archiver-hack-reveals-a-long-ignored-windows-vulnerability-review-geek\/#Microsoft_Needs_to_Address_Old_Help_Files\" >Microsoft Needs to Address Old Help Files<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h1><span class=\"ez-toc-section\" id=\"%E2%80%9CNew_7-Zip_Archiver_Hack_Reveals_a_Long_Ignored_Windows_Vulnerability_%E2%80%93_Review_Geek%E2%80%9D\"><\/span>&#8220;New 7-Zip Archiver Hack Reveals a Long Ignored Windows Vulnerability \u2013 Review Geek&#8221;<span class=\"ez-toc-section-end\"><\/span><\/h1>\n<div id=\"article-content-area\">\n<figure style=\"width: 1920px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"type:primaryImage size-full wp-image-115347\" data-pagespeed-lazy-srcset=\"https:\/\/www.reviewgeek.com\/p\/uploads\/2022\/04\/9b66b3c6.png?width=400 400w, https:\/\/www.reviewgeek.com\/p\/uploads\/2022\/04\/9b66b3c6.png?width=1200 1200w\" sizes=\"auto, 400w, 1200w\" data-pagespeed-lazy-src=\"https:\/\/www.reviewgeek.com\/p\/uploads\/2022\/04\/9b66b3c6.png?width=1200\" alt=\"\" width=\"1920\" height=\"1080\" src=\"\/pagespeed_static\/1.JiBnMqyl6S.gif\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><figcaption class=\"wp-caption-text\"><span class=\"type:primaryImage imagecredit\"><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/commons.wikimedia.org\/wiki\/File:7-Zip_screenshot_vista.png\">Wikimedia Commons<\/a><\/span><\/figcaption><\/figure>\n<p>The latest versions of 7-Zip contain a vulnerability (<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/github.com\/kagancapar\/CVE-2022-29072\">CVE-2022-29072<\/a>) that lets hackers gain administrative privileges on a system. But this vulnerability, which exploits the 7-Zip help file, should alarm all Windows users, as it highlights an age-old problem on Windows systems.<\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"How_Does_the_Exploit_Work\"><\/span>How Does the Exploit Work?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>As you may know, 7-Zip is a pretty old piece of open-source software. Its interface, buttons, and help menu haven\u2019t changed much since 1999. The help menu is especially nostalgic\u2014it relies on a .chm help file, which is a relic from the days of Windows 98.<\/p>\n<p>These old .chm files are pretty versatile. When opened, they can display HTML and Java<a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">script<\/a>, making them a solid option for e-books, dictionaries, and other documentation. But they\u2019re also <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/definition\/CHM\">easily exploited<\/a>, as they can run malicious code and effectively substitute for an executable.<\/p>\n<p>Now, 7-Zip\u2019s help file doesn\u2019t contain malware. But as\u00a0<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/github.com\/kagancapar\/CVE-2022-29072\">kagancapar<\/a>\u00a0explains, hackers can use this file to execute malicious code on your system.<\/p>\n<lite-youtube videoid=\"sT1cvbu7ZTA\" style=\"background-image: url('https:\/\/i.ytimg.com\/vi\/sT1cvbu7ZTA\/hqdefault.jpg');\">\n<button type=\"button\" class=\"lty-playbtn\"><br \/>\n<span class=\"lyt-visually-hidden\">Play Video<\/span><br \/>\n<\/button>\n<\/lite-youtube>\n<p>The process here is a bit wonky, so stay with me. Hackers with local or remote access to your computer can drag a .7z archive into the 7-Zip help menu to open a command prompt with admin privileges. The cmd.exe prompt runs as a child process under\u00a07zFM.exe, which is quite odd.<\/p>\n<p>A misconfiguration in the\u00a07z.dll file and heap overflow appear to be responsible for this problem. Normally, dragging a file into the 7-Zip help menu should do nothing. I should note that a similar problem<a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.exploit-db.com\/exploits\/47526\"> recently affected WinRAR<\/a>, another archiving tool.<\/p>\n<p>Realistically, the average person won\u2019t be affected by this exploit. It requires local or remote access to your computer, and if a hacker manages to get that far, then you\u2019re already screwed. If you\u2019re worried about this vulnerability, you can simply delete 7zip.chm. It should be under\u00a0<strong>C:\\Program Files\\7-Zip<\/strong> or <strong>C:\\Program Files (x86)\\7-Zip<\/strong>, depending on whether you use the 64-bit or 32-bit version.<\/p>\n<p>Note that this problem only seems to affect the latest version of 7-Zip (21.07). This particular update launched in December of 2021, and 7-Zip hasn\u2019t confirmed plans to patch the problem.<\/p>\n<p>Sill, escaping from this vulnerability may not save you from future .chm exploits, as Microsoft is partially responsible for such hacks.<\/p>\n<h2 role=\"heading\" aria-level=\"2\"><span class=\"ez-toc-section\" id=\"Microsoft_Needs_to_Address_Old_Help_Files\"><\/span>Microsoft Needs to Address Old Help Files<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<figure style=\"width: 1920px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-98313\" data-pagespeed-lazy-src=\"https:\/\/www.reviewgeek.com\/p\/uploads\/2021\/09\/ec3f690e.png\" alt=\"The Surface Pro 8, Surface Go 3, and upgraded Surface Pro X\" width=\"1920\" height=\"1080\" src=\"\/pagespeed_static\/1.JiBnMqyl6S.gif\" onload=\"pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\" onerror=\"this.onerror=null;pagespeed.lazyLoadImages.loadIfVisibleAndMaybeBeacon(this);\"\/><figcaption class=\"wp-caption-text\"><span class=\"imagecredit\"><a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/blogs.windows.com\/devices\/?p=263200\">Microsoft<\/a><\/span><\/figcaption><\/figure>\n<p>By default, Windows tries to open .chm files in the old HTMLHelper, also called hh.exe. This viewer executes HTML and Javascript and provides very little protection from exploits. Hackers are known to use .chm files to run malicious code in HTMLHelper, usually <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/malicious-chm-files-being-used-to-install-brazilian-banking-trojans\/\">through phishing schemes<\/a>.<\/p>\n<p>Microsoft has made some lightweight attempts to fight this problem\u2014Outlook no longer opens .chm files, and many .chm files are automatically blocked from running in Windows. But as we see with today\u2019s <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/news\/\" data-internallinksmanager029f6b8e52c=\"2\" title=\"News\" target=\"_blank\" rel=\"noopener\">news<\/a>, HTMLHelper and .chm files present an ongoing security risk for Windows PCs.<\/p>\n<p>You could blame 7-Zip for leaving bugs in its software, but realistically speaking, a misconfigured .dll file shouldn\u2019t let hackers run malicious code on your computer. The problem lies with Microsoft and its HTMLHelper software.<\/p>\n<p>I suggest avoiding .chm files until Microsoft finds a way to resolve this problem. That said, you shouldn\u2019t uninstall hh.exe, as doing so could negatively impact system performance.<\/p>\n<p><small>Source: <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/winfuture-de.translate.goog\/news,129171.html?_x_tr_sl=auto&amp;_x_tr_tl=en&amp;_x_tr_hl=en&amp;_x_tr_pto=wapp\">WinFuture<\/a><\/small>\n<\/div>\n<p><script>\nsetTimeout(function(){\n  !function(f,b,e,v,n,t,s)\n  {if(f.fbq)return;n=f.fbq=function(){n.callMethod?\n  n.callMethod.apply(n,arguments):n.queue.push(arguments)};\n  if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version='2.0';\n  n.queue=[];t=b.createElement(e);t.async=!0;\n  t.src=v;s=b.getElementsByTagName(e)[0];\n  s.parentNode.insertBefore(t,s)}(window, document,'script',\n  'https:\/\/connect.facebook.net\/en_US\/fbevents.js');\n  fbq('init', '1137093656460433');\n  fbq('track', 'PageView');\n  },3000);\n<\/script><\/p>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more like this article, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/technology\/\" target=\"_blank\" rel=\"noopener\">Technology category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/www.reviewgeek.com\/115336\/new-7-zip-archiver-hack-reveals-a-long-ignored-windows-vulnerability\/\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;New 7-Zip Archiver Hack Reveals a Long Ignored Windows Vulnerability \u2013 Review Geek&#8221; Wikimedia Commons The latest versions of 7-Zip contain a vulnerability (CVE-2022-29072) that lets hackers gain administrative privileges on a system. But this vulnerability, which exploits the 7-Zip help file, should alarm all Windows users, as it highlights an age-old problem on Windows&#8230;<\/p>\n","protected":false},"author":1,"featured_media":433607,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.reviewgeek.com\/p\/uploads\/2022\/04\/9b66b3c6.png","fifu_image_alt":"","footnotes":""},"categories":[18],"tags":[],"class_list":["post-433606","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/433606","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=433606"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/433606\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/433607"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=433606"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=433606"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=433606"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}