Alarming 7-Zip Security Flaw Exposes Your PC To Hackers Giving Full
Admin Rights
<https://hothardware.com/news/7-zip-security-flaw-grants-full-admin-rights>

.....

When utilizing 7-Zip's help menu, it executes the hh.exe, which can
still run and use ActiveX objects. If you attempt to drag a .7z
extension file to that window that appears, after malware or an attacker
has run their piece to unlock the nasty potential of elevated access, it
can potentially open up a command prompt with elevated administrator
access. This is displayed in the video made by Kağan Çapar, a security
researcher from Turkey.

Kağan does state in his GitHub, which outlines the vulnerability, that
he will not publish the details of the exploit until after the issue is
patched by the 7-Zip developers. No action has been taken yet,
unfortunately. He does, however, go on to say that the bug report has
been issued to 7-Zip developers, and that its CVE-2022-29072 designation
has been submitted to security reporting web sites.

.....

On Mon, 25 Apr 2022 19:09:34 +0800, Mr. Man-wai Chang wrote:
>
> Alarming 7-Zip Security Flaw Exposes Your PC To Hackers Giving Full
> Admin Rights
> <https://hothardware.com/news/7-zip-security-flaw-grants-full-admin-rights>
>
> When utilizing 7-Zip's help menu, it executes the hh.exe, which can
> still run and use ActiveX objects. If you attempt to drag a .7z
> extension file to that window that appears, after malware or an attacker
> has run their piece to unlock the nasty potential of elevated access, it
> can potentially open up a command prompt with elevated administrator
> access. This is displayed in the video made by Kagan Çapar, a security
> researcher from Turkey.
>
> Kagan does state in his GitHub, which outlines the vulnerability, that
> he will not publish the details of the exploit until after the issue is
> patched by the 7-Zip developers. No action has been taken yet,
> unfortunately. He does, however, go on to say that the bug report has
> been issued to 7-Zip developers, and that its CVE-2022-29072 designation
> has been submitted to security reporting web sites.

I saved this in April, intending to do something about it Real Soon
Now. It took me only six months to get around to downloading the
latest 7Zip version -- it's 22.01, dated July 2022. Then I went
looking for release notes, and found them in the forum(*), at

https://sourceforge.net/p/sevenzip/discussion/45797/thread/c43cbc5f18

A forum user asked, "Is the CVE problem with the help file fixed?
Or are you already working on a version that fixes this
vulnerability? So is there maybe already a timeframe when this CVE
problem will be fixed?"

The reply was "The CVE-2022-29072 is disputed and multiple security
researchers have declared it a hoax." There's more discussion, which
you can read at the above URL.

(*) BTW, more complete release notes are here:
https://7-zip.org/history.txt

--
Stan Brown, Tehachapi, California, USA https://BrownMath.com/
Shikata ga nai...

"Stan Brown" <the_stan_brown@fastmail.fm> wrote

| The reply was "The CVE-2022-29072 is disputed and multiple security
| researchers have declared it a hoax."

Indeed. It's not a webpage. They're saying, essentially,
that if you have executable software on your computer
with malware present, the malware may be able to exploit it.
With ninny warnings like that it's no surprise that tech
companies are getting away with selling locked down
devices.