7-ZIP Version 18.05 Released

With the new version 18.05 released. I was met with a challenge to update allot of clients and my own computer in a way because of a security breach that was patched. So I took what I learned from other scripts I created and created this new script to install or update 7-Zip using PowerShell. Now of course the argument against this could be made for why create this because stable versions of 7-Zip do not come often. However it is a script that I share in the case that you need it. Maybe that is not now but when you do need to quickly update your own or other computers with the latest 7-Zip build here you are.

7-ZIP Version 18.05 released

In the previous post on the 7-Zip bugs CVE-2017-17969 and CVE-2018-5996,I mentioned the lack of DEP and ASLR in 7-Zip before version 18.00 (beta).Shortly after the release of that blog post, Igor Pavlov released 7-Zip 18.01with the /NXCOMPAT flag, delivering on his promise to enable DEP on all platforms.Moreover, all dynamic libraries (7z.dll, 7-zip.dll, 7-zip32.dll) have the /DYNAMICBASE flag and a relocation table.Hence, most of the running code is subject to ASLR.

Obviously, ASLR can only be effective if all modules are properly randomized.I discussed this with Igor and convinced him to ship the main executables of the new 7-Zip 18.05 with /DYNAMICBASEand relocation table.The 64-bit version still runs with the standard non-high entropy ASLR (presumably because the image base is smaller than 4GB),but this is a minor issue that can be addressed in a future release.