Top all-time · #6972
landave's blog
Personal blog · landave.io · on HN as landavesecurity
landave's blog is a personal blog at landave.io about security. Since 2017, 11 different Hacker News readers have linked it 25 times, most often “7-Zip: Multiple Memory Corruptions via RAR and ZIP”. The last post was in 2020, but the archive is still widely read.
Too few sampled comments (9) to say how often HN recommends it.?
Why HN links it
HN readers link landave's blog as the primary write-up of security bugs, mainly the 2018 7-Zip memory corruption and uninitialized-memory remote code execution posts, which commenters cite as the source for those findings.
Summarised by Claude from a sample of 9 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Blog about anti-virus software vulnerabilities.
Most-linked posts?
- 7-Zip: Multiple Memory Corruptions via RAR and ZIP6 people · 8 mentions · first linked 2018-01-23
- Bitdefender: Remote Stack Buffer Overflow via 7z PPMD2 people · 2 mentions · first linked 2017-07-18
- Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers2 people · 2 mentions · first linked 2017-06-27
- 7-Zip: From Uninitialized Memory to Remote Code Execution2 people · 2 mentions · first linked 2018-05-02
What Hacker News says?
https://landave.io/2018/01/7-zip-multiple-memory-corruptions... but also see: https://news.ycombinator.com/item?id=16986377
Comment linking /2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/
on “PeaZip: Open-source file compression and encryption software”Submitted 7-Zip: From Uninitialized Memory to Remote Code Execution as a story · 342 points
HN discussionThat's right, they patched CVE-2017-17969, which affected ZIP decompression. Interestingly, I believe they didn't patch CVE-2018-5996 (affecting RAR), which I published [0] on January 23 together with CVE-2017-17969. [0]: https://landave.io/2018/01/7-zip-multiple-memory-corruptions...
Comment linking /2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/
on “7-Zip: From Uninitialized Memory to Remote Code Execution”Submitted 7-Zip: Multiple Memory Corruptions via RAR and ZIP as a story · 252 points
HN discussionGreat, p7zip is also affected according to an earlier article [1] and the last version 16.02 is from 2016 [2] This open source libraries are used everywhere :( [1]: https://landave.io/2018/01/7-zip-multiple-memory-corruptions... [2]: https://sourceforge.net/projects/p7zip/files/p7zip/
Comment linking /2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/
on “7-Zip: From Uninitialized Memory to Remote Code Execution”Submitted Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers as a story · 245 points
HN discussionI'm always uneasy when I install software in Windows because it means I have to trust another third-party. If I have 100 programs on my Windows PC, I've had to trust 100 third-party organisations with my computer and all the data on it. Not only that, but I've also had to trust my own judgement to find the correct website for all those programs, and not copycats that wrap the program in malware. Sometimes I check Wi…
Comment linking /2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/
on “Using Windows after 15 years on Linux”Submitted F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking as a story · 105 points
HN discussionA whole lot of 5 users, I realize that in bigger companies it's probably less hassle to just install AV software and "hardblock" undesired behavior. I imagine that depending on the country you are operating in this might even be a requirement to prevent legal hassle, getting sued for "neglect" if not running AV software and something actually goes wrong but IANAL. But let's also keep in mind that AV solutions can ha…
Comment linking /2017/06/avast-antivirus-remote-stack-buffer-overflow-with-magic-numbers/
on “7-Zip: Multiple Memory Corruptions via RAR and ZIP”Submitted Bitdefender Anti-Virus: Heap Buffer Overflow via 7z LZMA as a story · 83 points
HN discussionDo you have description on the procedure of how you did all this by chance (especially, how did you get that graph[0])? I'm interested in reverse engineering, but can't find many good starting points to do it myself. And congrats on your achievement, we need more people like you, who put such shoddy programming practices in broad daylight, especially made by the companies that are supposed to make us safer. 0. https…
Comment linking /files/add_magicnum.png
on “Avast Antivirus Remote Stack Buffer Overflow with Magic Numbers”Submitted 7-Zip: Multiple Memory Corruptions via RAR and ZIP as a story · 5 points
HN discussionhttps://twitter.com/wdormann/status/955802146045353985 DEP would be nice, wouldn't it? IIRC, Igor finally added DEP a few months ago (NXCOMPAT if you need to google the Internet Drama). But the fact that he was running this code without lol DEP until January of THIS YEAR makes me suspect his coding practices. As per this other page: https://landave.io/2018/01/7-zip-multiple-memory-corruptions... > I have discussed t…
Comment linking /2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/
on “Windows 10 works incorrectly with Large memory pages”Submitted Bitdefender: UPX Unpacking Featuring Ten Memory Corruptions as a story · 4 points
HN discussionThere's a big difference between quality code and being a cowboy. > I don't know Igor, but if 7z is anything to go by then he probably uses VC--I'm guessing here--6 for the same reason Sean Barrett does: It's way faster and less bloated than modern VS. Then they should learn how to download the SDK and learn to use the command line to properly compile code with proper ASLR and other such security features. Keep work…
Comment linking /2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/
on “Windows 10 works incorrectly with Large memory pages”Submitted Bitdefender: Remote Stack Buffer Overflow via 7z PPMD as a story · 4 points
HN discussionI misremembered, it was binary size (even more stupid) https://landave.io/2018/01/7-zip-multiple-memory-corruptions...
Comment linking /2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/
on “Windows 11 x64 security hardening guide”Submitted 7-Zip: From Uninitialized Memory to Remote Code Execution as a story · 3 points
HN discussionRelease notes for version 18.05, 2018-04-30 include: > CVE-2018-10115 - Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service (segmentation fault) or execute arbitrary code via a crafted RAR archive. Excellent article from the bug discoverer here: https://landave.io/2018/05/7-zip-from-uninitial…
Comment linking /2018/05/7-zip-from-uninitialized-memory-to-remote-code-execution/
on “A serious security vulnerability has been found in 7-Zip”Submitted Bitdefender: UPX Unpacking Featuring Ten Memory Corruptions as a story · 1 points
HN discussionLocation: Zurich, Switzerland Remote: Yes (flexible) Willing to relocate: Yes Technologies: C/C++, Java, OpenCL, Python, X86/X86_64, Haskell, IDA Pro, Git, Linux, Windows Résumé/CV: https://landave.io/ , https://www.linkedin.com/in/landave/ , detailed CV upon request Email: blog+hn |[at]| landave |[dot]| io Hi, I am Dave. I just defended my PhD thesis in cryptography at ETH Zurich. I am broadly interested in systems…
Comment linking /
on “Ask HN: Who wants to be hired? (October 2023)”Submitted F-Secure Anti-Virus: Remote Code Execution via Solid RAR Unpacking as a story · 1 points
HN discussionSubmitted Bitdefender Remote Stack Buffer Overflow via 7z PPMD as a story · 1 points
HN discussionSubmitted Announcing a new blog series on anti-virus software as a story · 1 points
HN discussion
