Malwarebytes and 7zip library

[Malika4]

Hi,

 

yesterday I read an article about 2 high vulnerabilities in the 7zip program:

• Improper exception handling in 7-Zip’s RAR3 handler can cause heap or stack memory corruptions (CVE-2018-5996)
• A heap buffer overflow vulnerability in 7-Zip’s shrink decoder. (CVE-2017-17969)

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

It was released a new version 18.01 that removes the vulnerabilities.

So in Malwarebytes 3.3.1.2183 there are 2 7z.dll libraries and are from version 16.4.0  that has the 2 vulnerabilities so I would know is a risk? There will be from Malwarebytes an update of this 2 7z.dll?

 

Thanks

[Aura]

Hi Malika,

Refer to the thread below.

https://forums.malwarebytes.com/topic/183068-malwarebytes-anti-malware-and-the-7-zip-vulnerabilities/

Thank you.

[Malika4]

Thanks, The post is for The vulnerabilities found on 2016, Malwarebytes is Not affected with these new vulnerabilities found this week?

Edited January 31, 2018 by Malika4

[Aura]

Oh my bad, I thought you were referring to the vulns found in 2016 (since 2 of them were also found in 2016). We'll need to wait for a Staff member to answer that one.

[AlexSmith]

Hi @Malika4!!

Like you called out, the current release of Malwarebytes uses version 16.04 of the 7Zip DLL with CVE-2018-5996 and CVE-2017-17969. We are aware if this and are working on an updated release.

@jprism can you share some more info here?

[jprism]

Thanks, Alex.

We are planning to upgrade the 7zip version in the next MB3 release that should be out by the first week of February.  This fix will be included in the Beta of the next MB3 release, so if anyone wants it sooner, we advise to use the "Beta Application updates" found in the "Settings->Application" tab.

hope this helps.

[Malika4]

ok thanks, I'll wait the new release with the new version of 7z.dlll
Thanks again