PeaZip 2.6.2

Vrijdag is versie 2.6.2 van PeaZip verschenen. PeaZip is een onder een opensource-licentie beschikbaar gesteld archiveringsprogramma dat zich van de concurrentie probeert te onderscheiden door zich te specialiseren in veiligheid. Het versleutelen van data is dan ook het speerpunt van het eigen pea-formaat. Het programma kan 7z-, bz2-, gz-, paq/lpaq-, pea-, quad-, tar-, upx- en zip-bestanden creëren en diverse bestandsformaten uitpakken, waaronder ace, arj, cab, deb, iso, lha, rar en rpm. In deze release is nu ook de Linux-backed bijgewerkt naar versie 9.04 van p7zip en is er een beveiligingsprobleem verholpen:

Changes in version 2.6.2:

• p7zip backend updated to 9.04 (Linux)
• tightened sanitization of input strings in PeaZip GUI, as security fix against a class of possible attacks based on code injection (ref: http://secunia.com/advisories/35352/ http://milw0rm.com/exploits/8881 original submission: http://retrogod.altervista.org/). To attack previos releases an attacker could build archives containing objects with nonvalid filenames, containing concatenated commands in the filename "hidden" to the user by making the filename very long with spaces to trick users in non reading the latter part of the name. If unaware users had downloaded such archive and doubleclicked or otherwise opened the archived file entry containing the concatenated command, would have put in execution the command (with current user rights). Fixes:
  • check file/dir names for:
    • non-allowed characters (0..31)
    • reserved characters
    • reserved file names
    • unusual spacing (5 consecutive or more, like in 7-Zip GUI), as may be intended to trick user hiding real filename
  • check command string immediately before execution for:
    • non-allowed characters
    • reserved characters for command concatenation (|<>), not used by PeaZip GUI
    • unusual spacing