Hacker News

points by pasteleft 2 days ago | 0 comments

Paint can exectue arbitrary code from the REMOTE, without USER INTERACTION?????

We seriously need more information.

Paint’s image decoding engine is a shared system component and during thumbnail and visual preview generation it gets called automatically without opening the GUI. Ergo it’s enough for a malformed image file to exist on your device to get pwnd.

[–] jasomill 1 day ago

Do you have details on this? Given that this is classified as a network vulnerability of the Paint application itself rather than any shared system components, I assumed it had to do with the recently-introduced Copilot features which AFAIK are the only part of the application that directly interact with the network.

[–] bushbaba 1 day ago

Feels like this was placed on purpose

[–] hulitu 2 days ago

Every program which has telemetry can. And web browsers.

[–] weavie 1 day ago

How?

[–] joshspankit 1 day ago

While I understand your phrasing getting downvoted, I agree with what I assume you mean:

1. Telemetry as implemented is usually sloppy. Even though intuitively one could think that telemetry means “data gets collected locally and fired off to a remote server”, we have seen time and time again that they also build a return path to make the telemetry gathering more powerful. That return path can be a vector.

2. Web browsers have a _huge_ surface and they connect to remote servers constantly. The industry does very well at being proactive and at addressing CVEs but the whole premise makes that very difficult and so we cannot absolutely claim that browsers don’t have RCE(s).

[–] embedding-shape 1 day ago

> That return path can be a vector

What return path could possibly lead to a RCE? That's crazy, no telemetry requires "backend could return any command that gets run on the client", you're doing telemetry in a very non-standard way if this is even possible.

At worst, the telemetry backend might first send the client a config, but none of that would contain executable commands because again, that'd be crazy.

> we cannot absolutely claim that browsers don’t have RCE(s).

Of course, you can never prove the absence of bugs (and/or security issues), but given that browsers aren't wildly exploited at this very moment, nor have been for quite some time, we can pretty confidently claim there are no browser RCEs in wide use today.

It's true that browsers have pretty big attack surface, but it's also true that it's the class of software that gets the more pentesting, since the payoff would be so great when you manage to find holes.

[–] Someone 1 day ago

> What return path could possibly lead to a RCE?

API protocol says “return value is either “OK” or “ERR””, attacker sends “Floccinaucinihilipilification”, overflowing the 3-byte response buffer allocated on the stack.

[–] embedding-shape 1 day ago

Right, so you have the first step of something, but then depending on everything else, this is either a DOS or a RCE.

I'm claiming if "everything else" does indeed lead to a RCE, you're again doing something very wrong here. It's not rocket science exactly.

[–] Someone 1 day ago

It’s harder nowadays, with address space layout randomization and no-execute stacks, but the basics are

- https://en.wikipedia.org/wiki/Stack_buffer_overflow#stack_sm...

- https://en.wikipedia.org/wiki/Return-oriented_programming

I think that’s how lots of RCE bugs start, so it may not be rocket science, but lots of software falls for it.

[–] embedding-shape 1 day ago

I'm sorry, but I still find it hard to believe you work with other professionals that when they implement telemetry in client applications, that usually ends up exposing a RCE on the client because of the telemetry implementation.

[–] port11 1 day ago

But only these 2, only software with telemetry and web browsers. There are no RCEs in anything else…

[–] IAmBroom 1 day ago

Citation required for extraordinary claim.

[–] embedding-shape 1 day ago

> Every program which has telemetry can

I'd go out on a limb here perhaps, but I'd claim that if your telemetry means that the one SENDING the data gets a RCE by default by it, you're doing telemetry very wrong. Maybe look into different libraries/services than the ones you use today, please.

[–] monster_truck 2 days ago

If I had to guess, without diffing old/new, it's probably related to the generative erase/ai shit.

To stack assumptions, I'd reach for something like using the recent certificate circus to present as there being an updated version of whatever model it uses on the PCs that can run it locally to give it a fucked up model that does the out of bounds shit as part of whatever verification/checks it does after its downloaded/installed.

[–] johnisom2001 1 day ago

> If I had to guess, ... > To stack assumptions, ...

So, you're saying nothing? It would have been more useful to never have posted.

[–] _notreallyme_ 1 day ago

Either the description or the impact is wrong. You can't trigger MS Paint in a '0-click' attack, and OOB read are not sufficient to directly obtain code execution. So I'll let you guess which one is wrong.

It's quite common with vulnerabilities found by IA, there might be less hallucination, but the impact/score is often completely wrong.

[–] boringg 1 day ago

Finally MS Paint has entered the OPSEC battle royale currently being waged.

[–] BobbyTables2 1 day ago

Couldn’t let Notepad keep the its title uncontested, right?