Question on missing NVT 1.3.6.1.4.1.25623.1.0.834786 (CVE-2024-11477 / 7-Zip Zstandard) result

Scanning / scan configuration
1

Moderator note: The analysis here contains wrong information / claims which are not valid.

Summary:
The vulnerability check for CVE-2024-11477 does not flag vulnerable 7-Zip installations on x64 Windows systems, due to a CPE format mismatch between the detection script and the vulnerability script.

Affected NVT:

  • Name: 7-Zip Zstandard Decompression Integer Underflow Vulnerability - Windows

  • OID: 1.3.6.1.4.1.25623.1.0.834786

  • File: 2024/7zip/gb_7zip_zstandard_decompression_integer_underflow_vuln_win.nasl

  • CVE: CVE-2024-11477

Details of the mismatch:

  1. The detection script (gb_7zip_detect_win.nasl, OID 1.3.6.1.4.1.25623.1.0.800260) correctly identifies an installed x64 7-Zip and registers it as: cpe:/a:7-zip:7-zip:x64:23.01

  2. The vulnerability script hardcodes its lookup CPE as the generic base variant:

nasl

CPE = “cpe:/a:7-zip:7-zip”;

and calls:

nasl

get_app_version_and_location(cpe:CPE, exit_no_version:TRUE)

  1. CVE-2024-11477’s own affected-products list (confirmed via get_info type='CVE' name='CVE-2024-11477') lists the vulnerable version without an architecture qualifier: cpe:/a:7-zip:7-zip:23.01

Because the host is registered under the x64-qualified CPE but the script looks up the generic/non-qualified CPE, get_app_version_and_location() fails to find a match, and the check silently exits without generating a result — even though the host is genuinely running a vulnerable version (23.01 < fixed version 24.07).

Steps to reproduce:

  1. Install 7-Zip 23.01 (x64 build) on a Windows Server target.

  2. Add the target to GVM with valid SMB credentials for authenticated scanning.

  3. Run a “Full and fast” scan (default scan config) against the target.

  4. Confirm in the report’s Applications tab that 7-Zip is detected as cpe:/a:7-zip:7-zip:x64:23.01.

  5. Observe that no vulnerability result appears for CVE-2024-11477, despite the version being vulnerable.

Expected behavior:
The vulnerability check should match hosts registered under either:

  • cpe:/a:7-zip:7-zip:VERSION, or

  • cpe:/a:7-zip:7-zip:x64:VERSION (and other architecture qualifiers, e.g., x86)

Environment:

  • gvmd version: 23.1.0 (DB revision 255)

  • OpenVAS Scanner version: 22.7.9

  • Notus Scanner version: 22.6.2

  • Feed: Greenbone Community Feed (GCF)

  • Feed version at time of testing: 202607290749

  • Scan config used: Full and fast (default, unmodified)

  • Target OS: Windows Server 2022 Datacenter Azure Edition

Additional notes:
This appears to be a systemic issue potentially affecting other architecture-specific CPE registrations across similar NVTs, not just this one 7-Zip check — worth checking if other _win.nasl vulnerability scripts hardcode a base CPE while their corresponding detection scripts register arch-qualified variants.

2

Thanks kindly for the information, I have passed this along to our Vulnerability Tests Development team!

3

Hello,

and welcome to this community portal. While we appreciate community input please try to avoid jumping into conclusions too early. Furthermore if AI is used (the structure of this post indicates this) please disclose this, generally shorter Human written text is preferred as it makes analysis and similar easier.

In this case there is no VT/CPE side problem and the analysis is incorrect/insufficient (especially around get_app_version_and_location()) which can be best seen in the example below.

if(description) {
  script_oid("1.2.3");
  exit(0);
}

include("host_details.inc");
include("version_func.inc");

register_product(cpe:"cpe:/a:7-zip:7-zip:x64:23.01", location:"C:\some\path");

CPE = "cpe:/a:7-zip:7-zip";

if(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE))
  exit(0);

vers = infos["version"];
path = infos["location"];

if(version_is_less(version:vers, test_version:"24.07")) {
  report = report_fixed_ver(installed_version:vers, fixed_version:"24.07", install_path:path);
  security_message(port:0, data:report);
  exit(0);
}

exit(99);

which gives this on a short openvas-nasl run of it (to ease execution/testing):

Installed version: 23.01
Fixed version:     24.07
Installation
path / port:       C:\some\path

Note: The handling/usage of x64 in the version component of the CPE can be ignored for now, the responsible team is IIRC already aware of this and the involved functions seems to handle that internally.

1 Like