{"id":10457,"date":"2025-07-22T12:34:19","date_gmt":"2025-07-22T05:34:19","guid":{"rendered":"https:\/\/infosec.new88088.net\/?p=10457"},"modified":"2026-02-05T12:34:26","modified_gmt":"2026-02-05T05:34:26","slug":"lo-hong-7-zip-moi-co-the-khien-ung-dung-sap-khi-giai-nen-file-rar5-doc-hai","status":"publish","type":"post","link":"https:\/\/infosec.new88088.net\/2025\/07\/22\/lo-hong-7-zip-moi-co-the-khien-ung-dung-sap-khi-giai-nen-file-rar5-doc-hai\/","title":{"rendered":"L\u1ed7 h\u1ed5ng 7-Zip m\u1edbi c\u00f3 th\u1ec3 khi\u1ebfn \u1ee9ng d\u1ee5ng \u201cs\u1eadp\u201d khi gi\u1ea3i n\u00e9n file RAR5 \u0111\u1ed9c h\u1ea1i"},"content":{"rendered":"<div style=\"text-align: justify\"><b>M\u1ed9t l\u1ed7 h\u1ed5ng v\u1eeba \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n trong ph\u1ea7n m\u1ec1m gi\u1ea3i n\u00e9n ph\u1ed5 bi\u1ebfn 7-Zip, c\u00f3 th\u1ec3 khi\u1ebfn \u1ee9ng d\u1ee5ng b\u1ecb s\u1eadp ho\u00e0n to\u00e0n khi x\u1eed l\u00fd m\u1ed9t file RAR5 b\u1ecb ch\u1ec9nh s\u1eeda \u00e1c \u00fd. D\u00f9 kh\u00f4ng cho ph\u00e9p hacker chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n m\u00e1y, l\u1ed7i n\u00e0y \u0111\u1ee7 \u0111\u1ec3 t\u1ea1o ra t\u00ecnh hu\u1ed1ng t\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5 (DoS), khi\u1ebfn ph\u1ea7n m\u1ec1m ho\u1eb7c h\u1ec7 th\u1ed1ng gi\u00e1n \u0111o\u1ea1n, treo, t\u00ea li\u1ec7t.<\/b><br \/>\n\u200b<\/div>\n<div style=\"text-align: center\"><a class=\"js-lbImage\" style=\"cursor: pointer\" href=\"https:\/\/whitehat.vn\/attachments\/1753171211998-png.17351\/\" target=\"_blank\" rel=\"noopener\" data-lb-sidebar-href=\"\" data-lb-caption-extra-html=\"\" data-fancybox=\"lb-thread-18589\" data-caption=\"&lt;h4&gt;1753171211998.png&lt;\/h4&gt;&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;whitehat.vn&amp;#x2F;threads&amp;#x2F;lo-hong-7-zip-moi-co-the-khien-ung-dung-sap-khi-giai-nen-file-rar5-doc-hai.18589&amp;#x2F;#post-44098&quot; class=&quot;js-lightboxCloser&quot;&gt;WhiteHat Team \u00b7 22&amp;#x2F;07&amp;#x2F;2025 l\u00fac 3:01 PM&lt;\/a&gt;&lt;\/p&gt;\"><img fetchpriority=\"high\" decoding=\"async\" class=\"bbImage \" title=\"1753171211998.png\" src=\"https:\/\/whitehat.vn\/data\/attachments\/17\/17686-f9409c4fac95d3107740009223934a3d.jpg\" alt=\"1753171211998.png\" width=\"712\" height=\"400\" \/><\/a>\u200b<\/div>\n<div style=\"text-align: justify\">\nL\u1ed7i \u0111\u00e3 \u0111\u01b0\u1ee3c ch\u00ednh th\u1ee9c v\u00e1 trong phi\u00ean b\u1ea3n 7-Zip 25.00, ph\u00e1t h\u00e0nh ng\u00e0y 5\/7\/2025.<\/p>\n<p>L\u1ed7 h\u1ed5ng n\u1eb1m trong tr\u00ecnh x\u1eed l\u00fd \u0111\u1ecbnh d\u1ea1ng n\u00e9n RAR5 &#8211; m\u1ed9t chu\u1ea9n n\u00e9n ph\u1ed5 bi\u1ebfn. Khi g\u1eb7p file n\u00e9n b\u1ecb h\u1ecfng, 7-Zip c\u1ed1 g\u1eafng \u201cch\u1eefa ch\u00e1y\u201d b\u1eb1ng c\u00e1ch \u0111i\u1ec1n th\u00eam d\u1eef li\u1ec7u \u201c0\u201d \u0111\u1ec3 thay th\u1ebf ph\u1ea7n b\u1ecb l\u1ed7i. Nh\u01b0ng do t\u00ednh to\u00e1n sai k\u00edch th\u01b0\u1edbc b\u1ed9 nh\u1edb c\u1ea7n d\u00f9ng, ph\u1ea7n m\u1ec1m \u0111\u00e3 ghi \u0111\u00e8 ra ngo\u00e0i v\u00f9ng b\u1ed9 nh\u1edb cho ph\u00e9p, d\u1eabn \u0111\u1ebfn hi\u1ec7n t\u01b0\u1ee3ng \u201cr\u00f2 r\u1ec9 b\u1ed9 nh\u1edb\u201d v\u00e0 crash \u1ee9ng d\u1ee5ng.<\/p>\n<p>Hi\u1ec7n t\u01b0\u1ee3ng n\u00e0y g\u1ecdi l\u00e0 heap buffer overflow, khi ph\u1ea7n m\u1ec1m ghi d\u1eef li\u1ec7u v\u01b0\u1ee3t gi\u1edbi h\u1ea1n v\u00f9ng nh\u1edb \u0111\u01b0\u1ee3c c\u1ea5p ph\u00e1t, d\u1eabn t\u1edbi h\u00e0nh vi kh\u00f4ng ki\u1ec3m so\u00e1t \u0111\u01b0\u1ee3c, th\u1eadm ch\u00ed s\u1eadp \u1ee9ng d\u1ee5ng.<\/p>\n<p>L\u1ed7i n\u00e0y kh\u00f4ng gi\u00fap hacker \u0111i\u1ec1u khi\u1ec3n m\u00e1y nh\u01b0ng l\u1ea1i c\u1ef1c k\u1ef3 nguy hi\u1ec3m n\u1ebfu b\u1ea1n v\u00f4 t\u00ecnh gi\u1ea3i n\u00e9n m\u1ed9t file RAR5 b\u1ecb thi\u1ebft k\u1ebf \u0111\u1ed9c h\u1ea1i:\u200b<\/p><\/div>\n<ul>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">7-Zip s\u1ebd b\u1ecb \u0111\u00f3ng \u0111\u1ed9t ng\u1ed9t, g\u00e2y gi\u00e1n \u0111o\u1ea1n c\u00f4ng vi\u1ec7c.\u200b<\/div>\n<\/li>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">C\u00f3 th\u1ec3 \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn qu\u00e1 tr\u00ecnh t\u1ef1 \u0111\u1ed9ng gi\u1ea3i n\u00e9n trong h\u1ec7 th\u1ed1ng l\u1edbn, server ho\u1eb7c chu\u1ed7i c\u00f4ng c\u1ee5 CI\/CD.\u200b<\/div>\n<\/li>\n<li data-xf-list-type=\"ul\">\n<div style=\"text-align: justify\">Trong m\u00f4i tr\u01b0\u1eddng doanh nghi\u1ec7p ho\u1eb7c b\u1ea3o m\u1eadt cao, s\u1ef1 c\u1ed1 n\u00e0y c\u00f3 th\u1ec3 l\u00e0 c\u1eeda ng\u00f5 \u0111\u1ec3 khai th\u00e1c s\u00e2u h\u01a1n n\u1ebfu kh\u00f4ng ki\u1ec3m so\u00e1t t\u1ed1t.\u200b<\/div>\n<\/li>\n<\/ul>\n<div style=\"text-align: justify\">C\u00e1c nh\u00e0 nghi\u00ean c\u1ee9u b\u1ea3o m\u1eadt \u0111\u00e3 t\u1ea1o file m\u1eabu t\u00ean l\u00e0 &#8220;rar-crash.rar5&#8221; \u0111\u1ec3 ch\u1ee9ng minh l\u1ed7i v\u00e0 s\u1eed d\u1ee5ng c\u00f4ng c\u1ee5 ki\u1ec3m tra b\u1ed9 nh\u1edb (AddressSanitizer) \u0111\u1ec3 ph\u00e1t hi\u1ec7n v\u00f9ng d\u1eef li\u1ec7u b\u1ecb ghi \u0111\u00e8. K\u1ebft qu\u1ea3 cho th\u1ea5y 7-Zip b\u1ecb ghi tr\u00e0n ra ngo\u00e0i b\u1ed9 nh\u1edb \u0111\u1ec7m, g\u00e2y l\u1ed7i nghi\u00eam tr\u1ecdng v\u00e0 t\u1eaft ch\u01b0\u01a1ng tr\u00ecnh.<\/p>\n<p>T\u1ea5t c\u1ea3 ng\u01b0\u1eddi d\u00f9ng 7-Zip phi\u00ean b\u1ea3n t\u1eeb 12.97 \u0111\u1ebfn tr\u01b0\u1edbc 25.00 \u0111\u1ec1u c\u00f3 th\u1ec3 b\u1ecb \u1ea3nh h\u01b0\u1edfng n\u1ebfu m\u1edf ph\u1ea3i file RAR5 \u0111\u1ed9c h\u1ea1i. T\u00e1c \u0111\u1ed9ng l\u1edbn h\u01a1n n\u1ebfu d\u00f9ng 7-Zip trong h\u1ec7 th\u1ed1ng server, c\u00f4ng c\u1ee5 CI\/CD ho\u1eb7c trong c\u00e1c t\u1ed5 ch\u1ee9c x\u1eed l\u00fd file h\u00e0ng lo\u1ea1t. Nguy c\u01a1 khai th\u00e1c t\u1eeb xa l\u00e0 th\u1ea5p nh\u01b0ng kh\u1ea3 n\u0103ng t\u1ea5n c\u00f4ng DoS (s\u1eadp \u1ee9ng d\u1ee5ng) l\u00e0 ch\u1eafc ch\u1eafn, \u0111\u1eb7c bi\u1ec7t n\u1ebfu file \u0111\u01b0\u1ee3c d\u00f9ng trong quy tr\u00ecnh t\u1ef1 \u0111\u1ed9ng.<\/p>\n<p>Gi\u1ea3i ph\u00e1p v\u00e0 khuy\u1ebfn ngh\u1ecb cho ng\u01b0\u1eddi dung\u200b<\/p><\/div>\n<ul>\n<li data-xf-list-type=\"ul\">Ng\u01b0\u1eddi d\u00f9ng n\u00ean c\u1eadp nh\u1eadt ngay l\u00ean phi\u00ean b\u1ea3n 7-Zip 25.00 ho\u1eb7c m\u1edbi h\u01a1n \u0111\u1ec3 tr\u00e1nh b\u1ecb khai th\u00e1c.<\/li>\n<li data-xf-list-type=\"ul\">Doanh nghi\u1ec7p c\u00f3 th\u1ec3 c\u00e2n nh\u1eafc:\n<ul>\n<li data-xf-list-type=\"ul\">Ki\u1ec3m tra file n\u00e9n tr\u01b0\u1edbc khi gi\u1ea3i n\u00e9n, nh\u1ea5t l\u00e0 file \u0111\u1ebfn t\u1eeb ngu\u1ed3n kh\u00f4ng r\u00f5 r\u00e0ng.<\/li>\n<li data-xf-list-type=\"ul\">Sandbox (c\u00e1ch ly) qu\u00e1 tr\u00ecnh gi\u1ea3i n\u00e9n, tr\u00e1nh \u0111\u1ec3 l\u1ed7i \u1ea3nh h\u01b0\u1edfng t\u1edbi h\u1ec7 th\u1ed1ng ch\u00ednh.<\/li>\n<li data-xf-list-type=\"ul\">Theo d\u00f5i log v\u00e0 gi\u00e1m s\u00e1t h\u1ec7 th\u1ed1ng gi\u1ea3i n\u00e9n t\u1ef1 \u0111\u1ed9ng \u0111\u1ec3 ph\u00e1t hi\u1ec7n crash b\u1ea5t th\u01b0\u1eddng.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<div style=\"text-align: justify\">D\u00f9 kh\u00f4ng ph\u1ea3i l\u00e0 m\u1ed9t l\u1ed7 h\u1ed5ng chi\u1ebfm quy\u1ec1n nghi\u00eam tr\u1ecdng nh\u01b0ng s\u1ef1 c\u1ed1 l\u1ea7n n\u00e0y l\u00e0 l\u1eddi nh\u1eafc nh\u1edf r\u1eb1ng k\u1ec3 c\u1ea3 nh\u1eefng ph\u1ea7n m\u1ec1m ph\u1ed5 bi\u1ebfn v\u00e0 l\u00e2u \u0111\u1eddi nh\u01b0 7-Zip c\u0169ng kh\u00f4ng tr\u00e1nh kh\u1ecfi sai s\u00f3t. Trong th\u1eddi \u0111\u1ea1i m\u00e0 vi\u1ec7c trao \u0111\u1ed5i file di\u1ec5n ra li\u00ean t\u1ee5c, m\u1ed9t l\u1ed7i t\u01b0\u1edfng ch\u1eebng \u0111\u01a1n gi\u1ea3n c\u0169ng c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh \u201c\u0111i\u1ec3m y\u1ebfu t\u1eed th\u1ea7n\u201d n\u1ebfu b\u1ecb k\u1ebb x\u1ea5u l\u1ee3i d\u1ee5ng \u0111\u00fang l\u00fac.\u200b<\/div>\n<div style=\"text-align: right\"><b><i>Theo WhiteHat t\u1ed5ng h\u1ee3p<\/i><\/b>\u200b<\/div>\n<div style=\"text-align: right;margin-top: 16px\"><i>Theo: <a href=\"https:\/\/whitehat.vn\/threads\/lo-hong-7-zip-moi-co-the-khien-ung-dung-sap-khi-giai-nen-file-rar5-doc-hai.18589\/\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/whitehat.vn\/threads\/lo-hong-7-zip-moi-co-the-khien-ung-dung-sap-khi-giai-nen-file-rar5-doc-hai.18589\/<\/a><\/i><\/div>\n","protected":false},"excerpt":{"rendered":"<p>M\u1ed9t l\u1ed7 h\u1ed5ng v\u1eeba \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n trong ph\u1ea7n m\u1ec1m gi\u1ea3i n\u00e9n ph\u1ed5 bi\u1ebfn 7-Zip, c\u00f3 th\u1ec3 khi\u1ebfn \u1ee9ng d\u1ee5ng b\u1ecb s\u1eadp ho\u00e0n to\u00e0n khi x\u1eed l\u00fd m\u1ed9t file RAR5 b\u1ecb ch\u1ec9nh s\u1eeda \u00e1c \u00fd. D\u00f9 kh\u00f4ng cho ph\u00e9p hacker chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n m\u00e1y, l\u1ed7i n\u00e0y \u0111\u1ee7 \u0111\u1ec3 t\u1ea1o ra t\u00ecnh hu\u1ed1ng t\u1eeb ch\u1ed1i [&hellip;]<\/p>\n","protected":false},"author":46,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33],"tags":[],"class_list":["post-10457","post","type-post","status-publish","format-standard","hentry","category-tin-tuc-cua-vien"],"_links":{"self":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10457","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/users\/46"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/comments?post=10457"}],"version-history":[{"count":0,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/posts\/10457\/revisions"}],"wp:attachment":[{"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/media?parent=10457"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/categories?post=10457"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.new88088.net\/wp-json\/wp\/v2\/tags?post=10457"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}