Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

141–150 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#141

Post by autoexec »

TZubiri wrote: post #136
Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

EDIT: THE OLD NOTEPAD IS STILL IN WINDOWS AND WE CAN USE IT! https://learn.microsoft.com/en-us/answers/questions/3845356/... You basically have to find the "execution alias" setting and disable notepad and you get the ole reliable :D OLD POST: This has hurt me specifically. Since I work without IDEs, no VIM, no vs code. On linux I use nano, on windows I use Notepad. I like the minimalism and the fact that I have abso…

EDIT.COM still works in dosbox

Re: Windows Notepad App Remote Code Execution Vulnerability

#142

Post by sbt567 »

w4yai wrote: post #117
ddtaylor wrote: post #99

Earlier quoted context omitted.

Do you have a moment to talk about Linux?

Half of my software don't work on Linux. My job also depends on running PE in a legitimate (read not Wine) environment - and I don't want to spend half of my RAM running VMs. What should I do ?

One day I'm trying a modified Windows (bloat stripped) from team-os. And the difference is night and day. My old laptop finally can run Windows 10!

I wonder though if there are more open and trusted modified Windows being developed out there because trying random modified Windows in team-os is not getting me some confidence

Re: Windows Notepad App Remote Code Execution Vulnerability

#143

Post by HugoTea »

setopt wrote: post #84
SomeUserName432 wrote: post #75

Earlier quoted context omitted.

I find notepad useful for sanitising clipboard content. No bold text, italics, bullet points, invisible html.. Just get the text and can copy it to paste again somewhere else. Ala Cmd+Shift+V on Mac

I somewhat regularly use the almost embarrassing key sequence Ctrl-C Ctrl-L Ctrl-V Ctrl-A Ctrl-X to sanitize text I’ve copied from a browser, using the address field to remove any formatting.

I do a similar thing but use the start menu search, Ctrl-C, WIN, Ctrl-V, Ctrl-A, Ctrl-X. You can do it all in one hand and can get really fast, assuming the start menu doesn't lag behind. There's also the downside that it publishes all of your clipboard content to Bing search so maintain vigilance for confidential data...

Re: Windows Notepad App Remote Code Execution Vulnerability

#144

Post by TZubiri »

r2vcap wrote: post #37

A few days ago, Notepad++ got compromised—apparently by a state actor (or a proxy). And now, today, Windows’ built-in Notepad has a fresh CVE. What a life. At this point, what am I supposed to do other than uninstall Windows completely? No real sandboxing, a mountain of legacy…

>No real sandboxing, a mountain of legacy…

You have:

- Windows Sandbox (consumer-level sandbox) - Creating a separate User (User folders are permission locked to their user by default, system binaries cannot be modified without admin access) - HyperV (VM hypervisor) - Edge Browsers

Don't get me wrong MSFT quality is dropping steeply, but this is still a strong point. For comparision, on Ubuntu, user folder by default can be read by all users.

Re: Windows Notepad App Remote Code Execution Vulnerability

#145

Post by TZubiri »

nananana9 wrote: post #96
dgxyz wrote: post #50

Earlier quoted context omitted.

Well technically Unixes like Linux are a mountain of legacy and they are fine. Windows is just a mountain of shit.

"Fine" Why does every Linux distro under the sun try so hard to protect the garbage under /usr/bin/ and /etc/ when literally the only files that matter to me are in /home, which is a free-for-all?

>Why does every Linux distro under the sun try so hard to protect the garbage under /usr/bin/ and /etc

Because a compromised user could infect shared executables and spread the infection. A bit harder to do with etc but for sure possible. The main target would be infecting bash and you are done from the get go.

>when literally the only files that matter to me are in /home, which is a free-for-all?

The home folder's read write is usually restricted to the user. The only scenario where this isn't the case to my knowledge is Ubuntu where others can read it, but this is just a huge flaw in Ubuntu that almost no other distro has.

Re: Windows Notepad App Remote Code Execution Vulnerability

#146

Post by TZubiri »

rmunn wrote: post #7

"An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files." I didn't even know Notepad would render Markdown.

I think it's very recent, I use it almost daily and only last week did I see a markdown file being rendered.

Re: Windows Notepad App Remote Code Execution Vulnerability

#148

Post by ptx »

seritools wrote: post #35
voidUpdate wrote: post #26

I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too

you can also just uninstall the "new" notepad, at which point Windows will let you run the old one again (which is still shipped!). By using a version that is _that_ old you do lose out on some of the actually useful updates legacy nodepad received, such as LF line ending support.

What? Did they accidentally revert the improvements they already made to previously shipped versions of the old notepad program?

Re: Windows Notepad App Remote Code Execution Vulnerability

#150

Post by petepete »

w4yai wrote: post #117
ddtaylor wrote: post #99

Earlier quoted context omitted.

Do you have a moment to talk about Linux?

Half of my software don't work on Linux. My job also depends on running PE in a legitimate (read not Wine) environment - and I don't want to spend half of my RAM running VMs. What should I do ?

If you have to use Windows, just grit your teeth and use it.

Thankfully I don't.

Post reply on HN