Hacker News

points by 6thbit 2 days ago | 0 comments

I wonder if it could be through a file:// or some deeplink custom url handler that opens in Paint and clicking on it with some carefully crafted file path could make it read out of bounds (since that's the associated weakness reported) and execute something.

[–] jdiff 2 days ago

Whatever it is, it doesn't require any clicking or user interaction. Maybe my imagination is just limited but I can't imagine why Paint is making itself available for incoming traffic on the network.

[–] 6thbit 2 days ago

Ah, no interaction. Yikes, doesn't make sense Paint would have a server tho.

Should be easy to verify for someone with a windows machine if it does.

[–] jdiff 2 days ago

Mine doesn't have a mouse or keyboard at the moment, so I'm only checking over an SSH->WSL connection. But it sure doesn't look like it's opening any ports from here.

So I guess either some random OS component is listening to the network and just-as-inexplicably asking Paint to do something for it. Or one of Paint's outbound connections is vulnerable if hijacked by a mitm. Network interception's one of the examples used for the "High" Attack Complexity rating that MS gave this CVE. Maybe powered by eMudhra for any systems that haven't revoked those certs? That'd be topical.

But still wouldn't really make sense. A patch for machines that are actively updating Paint but dodging cert revocations? Nothing really makes sense about this silly Paint CVE.