A vulnerability, which was classified as critical, was found in 7-zip up to 18.01 on Windows (File Compression Software). Affected is the function LsaAddAccountRights of the component Access Restriction. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

7-Zip through 18.01 on Windows implements the "Large memory pages" option by calling the LsaAddAccountRights function to add the SeLockMemoryPrivilege privilege to the user's account, which makes it easier for attackers to bypass intended access restrictions by using this privilege in the context of a sandboxed process.

The bug was discovered 04/09/2018. The weakness was shared 04/16/2018 (Website). The advisory is available at sourceforge.net. This vulnerability is traded as CVE-2018-10172 since 04/16/2018. It is possible to launch the attack remotely. A authentication is needed for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

The vulnerability was handled as a non-public zero-day exploit for at least 7 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 370886 (7-ZIP Privilege Escalation Vulnerability).

Upgrading to version 18.02 eliminates this vulnerability.

Productinfo

Type

• File Compression Software

Name

• 7-zip

Version

• 18.01

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion