points by dboreham 2 days ago | 0 comments
Presumably this is like many other graphics tool vulnerabilities this works by the attacker persuading a user to open a file that exercises the bug. Not terribly unusual.
[–] yread 2 days ago
[–] criddell 2 days ago
> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network.
What server is MS Paint running or what services does it provide?
Edit: Apparently you can use it to print an image from the command-line. Is that how this is being exploited?
[–] 80fj0348i 2 days ago
MS Paint has Copilot now
[–] criddell 2 days ago
Does that turn it into a server or service?
[–] 80fj0348i 2 days ago
I'm no expert but so much of Windows is implemented as services. svchost.exe is probably involved somehow. Like it wouldn't surprise me if Copilot is implemented as a service and it talks to Paint via IPC messages or something
[–] steve1977 2 days ago
But that alone wouldn't make the service listen on the network, even if it were the case.
[–] 80fj0348i 2 days ago
It would make sense that it could listen for messages like "your generated image is ready!" and pass bitmap data to Paint. And media like images are a common source of vulnerabilities since you're basically passing binary data into the software.
[–] lakeviewterrace 2 days ago
IIS (Internet Impasto Server)
> User Interaction: None
> Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.