Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

31–40 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#31

I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too

I extracted out notepad.exe, calc.exe and mspaint.exe from Windows 7. I use them on Windows 11. They work perfectly.

Re: Windows Notepad App Remote Code Execution Vulnerability

#32

I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too

> (though the "about notepad" dialog shows the windows 11 version for some reason??)

It's because the program just calls a Windows API to display the version dialog of Windows itself.

Re: Windows Notepad App Remote Code Execution Vulnerability

#33
post #24
post #17

Earlier quoted context omitted.

> viewing data is a fundamental failure of the principle of least privilege. I read the cwe not cve, was wrong. It's still early in the morning...

> If I read it correctly (but could be mistaken), it runs with setuid root I am certain you are mistaken. I couldn't find anything that hints at notepad running with elevated privileges.

People very often run notepad as administrator (anything launched from administrative powershell instances will run like this).

In fact, if you enabled developer mode on your computer there's a registry key that gets set to run notepad as admin, it's: `runas /savecred /user:PC-NAME\Administrator “notepad %1”` in HKEY_CLASSES_ROOT-> * -> shell -> runas (new folder) -> (Default)

And, if I'm not totally mistaken, notepad also has the ability to reopen files as administrator, but I don't remember how to invoke it.

Regardless, notepad is a very trusted application and is often run as Administrator. Often it's more trusted than any other utility to modify system files.

Re: Windows Notepad App Remote Code Execution Vulnerability

#34
post #29

I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too

It needs far more features apparently. Tons more. That's why Notepad++ is popular. Which also had a severe security vulnerability recently. Which was actively exploited by some state actor like China.

That recent Notepad++ incident was a supply chain attack, not a vulnerability in the original program.

Re: Windows Notepad App Remote Code Execution Vulnerability

#35

I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too

you can also just uninstall the "new" notepad, at which point Windows will let you run the old one again (which is still shipped!).

By using a version that is _that_ old you do lose out on some of the actually useful updates legacy nodepad received, such as LF line ending support.

Re: Windows Notepad App Remote Code Execution Vulnerability

#36

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

Question is, did they even realize they added a network-aware rendering stack...

Re: Windows Notepad App Remote Code Execution Vulnerability

#37
A few days ago, Notepad++ got compromised—apparently by a state actor (or a proxy). And now, today, Windows’ built-in Notepad has a fresh CVE. What a life.

At this point, what am I supposed to do other than uninstall Windows completely? No real sandboxing, a mountain of legacy…

Re: Windows Notepad App Remote Code Execution Vulnerability

#38

I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too

Win9x Notepad in particular can only load files up to 64KB in size (edit: and supports only ANSI encoding, no Unicode). There were some actually useful additions to it up until Windows 10 or so - for example being able to handle LF (in addition to CRLF) line endings. But yeah, everything added in Windows 11 is just pure bloat.

Re: Windows Notepad App Remote Code Execution Vulnerability

#39
post #29

Earlier quoted context omitted.

It needs far more features apparently. Tons more. That's why Notepad++ is popular. Which also had a severe security vulnerability recently. Which was actively exploited by some state actor like China.

That recent Notepad++ incident was a supply chain attack, not a vulnerability in the original program.

Strictly, no. But it was a vulnerability in the design of Notepad++, key elements here being the featureset that requires frequent updates and the lack of integrity checks during the upgrade process.

This has prompted me to move on from Notepad++ - it's sad, because I've used it for many years, but this is too much.

Post reply on HN