Windows 11's Major Update: New Compression Formats and Security Challenges

Microsoft’s latest major update for Windows 11 (KB5031455) has introduced native support for 11 new compression formats within File Explorer, expanding the system's file management capabilities to include popular formats such as RAR and 7z. While this update is a boon for those who manage diverse file archives, it also opens the door to a range of security risks—primarily due to its integration with the open-source libarchive library.

Enhancing User Convenience with Expanded Archive Support​

In our everyday computing experience, few things streamline workflows more than the ability to handle multiple file formats directly from the File Explorer. This update allows Windows 11 users to natively compress and decompress files without relying on third-party applications. Formats that have long been popular among power users, such as RAR and 7z, now receive first-class support. Each archive format has its unique methods of data compression and encryption, making file sharing more convenient and efficient.
For instance, beyond simple compression, these formats are often favored for reducing storage space while maintaining data integrity. Windows 11’s newfound capabilities showcase Microsoft’s commitment to integrating features that cater both to casual users and tech enthusiasts seeking advanced file management.

The Underlying Technology: libarchive's Role​

At the heart of these improvements lies libarchive, a widely respected open-source library that is renowned for its versatility in handling multiple archive formats. Libarchive isn’t a stranger to a multitude of operating systems—Linux, BSD, and macOS have long harnessed its capabilities. It powers essential tools and projects like ClickHouse, Homebrew, and Osquery, illustrating its robust utility. However, its widespread use also means that any vulnerabilities within the library have a broad impact.

Unmasking the Security Risks​

Despite libarchive's solid reputation and regular fuzzing by projects like Google’s OSS-Fuzz, recent security analyses have identified several critical vulnerabilities that could prove dangerous, especially when exploited against Windows 11’s implementation.

Key Vulnerabilities Identified​

• Remote Code Execution (RCE) Vulnerabilities (CVE-2024-20696 & CVE-2024-20697):
• These vulnerabilities were discovered by Microsoft's Offensive Research & Security Engineering (MORSE) team. They stem from inadequate bounds checking in the RAR decompression functions of libarchive. Specifically, the issues reside in the copy_from_lzss_window_to_unp and the execute_filter_e8 functions.
• Exploiting such flaws, an attacker might craft a malicious archive file that, when decompressed, executes arbitrary code on a victim’s machine. The implications of such attacks are severe, ranging from unauthorized data access to potentially full system compromise.
• Heap Buffer Overflow and Path Sanitization Flaws:
• Further analysis has exposed a heap buffer overflow issue along with vulnerabilities that allow for arbitrary file write/delete operations. These arise from insufficient sanitization measures when processing file paths in Windows 11. In essence, poorly sanitized input can allow attackers to manipulate file content, possibly overwriting or deleting critical files.

The “Half-Day” Vulnerability Window​

An interesting and worrying aspect is the delay in merging Microsoft's patches for libarchive back into its upstream repository. This discrepancy has created a “half-day” vulnerability window where vulnerabilities patched in Windows remain unaddressed in the broader libarchive project. This lag means that other projects using libarchive—in environments like ClickHouse—could remain at risk, despite Windows having applied the fixes. Such delays amplify the risk across the ecosystem and spotlight the complexity in maintaining security across open-source components.

Balancing Functionality and Security​

The integration of new compression formats in Windows 11 exemplifies a broader trend in software development—balancing enhanced functionality with the imperatives of security. On one hand, native integration boosts convenience by allowing for more comprehensive archive handling directly within File Explorer. On the other, it inadvertently broadens the system’s attack surface.

Mitigation and Best Practices​

For users and administrators aiming to safeguard their systems against these potential vulnerabilities, consider the following steps:

• Stay Updated: Always apply the latest Windows updates. Microsoft patches its forked version of libarchive (archiveint.dll) to address these vulnerabilities, although it's crucial to understand that vulnerabilities in the open-source version may persist.
• Cautious Archive Handling: Exercise caution when handling archives from untrusted sources. Verify file origins and be wary of unusual archive contents that could trigger security flaws.
• Regular Security Audits: For organizations using tools that rely on libarchive, implement regular security assessments. This practice can help ensure that extraneous factors such as delayed upstream patches do not jeopardize system integrity.
• Community Vigilance: Engage with the broader developer and security community. Open-source projects like libarchive rely heavily on community input for vulnerability disclosure and remediation, so staying informed about security advisories is essential.

The Road Ahead​

Windows 11’s adoption of expanded compression formats demonstrates Microsoft’s drive to enhance usability. However, as this case highlights, innovative new features can also introduce complex security challenges. As we see the landscape of cybersecurity evolve, the story here is not just about a patch or an update—it’s about the intricate dance between technological progress and the ever-present need for meticulous security practices.
With this update, the conversation around security in open-source integration becomes even more relevant. For Windows users, understanding the trade-offs between convenience and risk is vital. The path forward will undoubtedly require a blend of proactive patching, vigilant security practices, and continued collaboration between proprietary and open-source communities.
As always, keep your systems updated, remain cautious with untrusted archives, and join the broader Windows community conversations to share how you're mitigating these evolving risks.
Let us know your thoughts in the forum—how are you balancing convenience and security in your daily computing experience?

---

Source: CybersecurityNews https://cybersecuritynews.com/windows-11s-new-compression-formats-pose/