7-Zip Vulnerability Allows Mark of the Web Bypass

What changed

A vulnerability has been discovered in 7-Zip that allows attackers to bypass the Mark-of-the-Web (MOTW) protection mechanism. This flaw affects how archived files are handled, specifically during the extraction process.

When users extract files from a specially crafted archive, the MOTW is not applied to the extracted files, which can lead to arbitrary code execution in the context of the current user.

Who is affected

This vulnerability impacts various users and organizations that utilize 7-Zip for file compression and extraction.

Notable affected groups include individuals using 7-Zip on personal devices, businesses relying on 7-Zip for data management, and IT departments that deploy 7-Zip across their networks.

• 7-Zip users on Windows operating systems
• Organizations utilizing 7-Zip for file management
• IT departments deploying 7-Zip in enterprise environments

What to do

Users and organizations should remain vigilant and apply necessary updates to 7-Zip as they become available. Additionally, exercising caution when opening files from untrusted sources is crucial.

Consider implementing security measures such as file integrity checks and user training to mitigate the risk of exploitation.

• Monitor for updates from 7-Zip and apply them promptly.
• Educate users about the risks of opening files from unknown sources.
• Implement additional security controls to limit exposure to malicious files.