Summary
Under certain circumstances, opening a specially crafted 7-zip package can exploit an integer
underflow vulnerability in 7-zip versions up to and including 22.x
This vulnerability allows for a remote code execution, resulting in unauthorized (remote) access to,
change of data or disruption of the whole service.
Impact
The stated TRUMPF products include a vulnerable version of 7-zip which can be exploited to take overthe server they're installed on. This can impact confidentiality, integrity and availability of information onthe affected system.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| Boost <=V16.5 | Boost <=V16.5 | |
| FAB (Storage) <=V22.7 | FAB (Storage) <=V22.7 | |
| FAB-Boost mixed installation <=V22.7 | FAB-Boost mixed installation <=V22.7 | |
| Oseon (Storage) <=V3.2 | Oseon (Storage) <=V3.2 | |
| Oseon-Boost mixed installation <=V3.5 | Oseon-Boost mixed installation <=V3.5 | |
| TruTops Cell <=V2.31.0 | TruTops Cell <=V2.31.0 | |
| TruTops Classic <=V12.1 | TruTops Classic <=V12.1 | |
| TruTops Mark <=V6.2 | TruTops Mark <=V6.2 |
Vulnerabilities
Expand / Collapse allPpmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.
Remediation
Please download the replacement tool.
For additional questions please contact your TRUMPF Service with the PR number 501709.
Revision History
| Version | Date | Summary |
|---|---|---|
| 1 | 23.01.2024 08:00 | Initial revision. |
| 2 | 05.06.2025 15:28 | Fix: quotation mark |