Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

151–160 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#151

Post by kgwxd »

Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

The day calculator brought me to an MS Store login was the day I became a radical.

Re: Windows Notepad App Remote Code Execution Vulnerability

#152

Post by delaminator »

voidUpdate wrote: post #55
IsTom wrote: post #48

Earlier quoted context omitted.

> in the design of Notepad++ One could argue it's an issue with windows where you can't just pull updates using a package manager/app store.

You can if you use the windows store. It's just that you usually install things outside of that, unlike in linuxes where you generally use the package manager that can handle updates for you

Plus Windows Store is not supported on all version of Windows particularly Datacenter versions - your most valuable assets !!

Re: Windows Notepad App Remote Code Execution Vulnerability

#153

Post by szszrk »

avaer wrote: post #86
egorfine wrote: post #66

Earlier quoted context omitted.

Tools are almost never the problem. The application of tools is.

I 100% agree. I'm just trying to point out the problem isn't Microsoft AI slopping their software. Even if you slopped it, the software could turn out better than what they're putting out. There must be something much worse than slop going on to get to this point.

Notepad and mspaint have now copilot integration. With full authentication integration that will likely fail for people in corporate environment.

That's a slop if you ask me. Even if it wasn't vibe coded, it now want's me to vibe use it. Who the hell wanted that.

Re: Windows Notepad App Remote Code Execution Vulnerability

#154

Post by egeozcan »

nuancebydefault wrote: post #135
weinzierl wrote: post #59

Earlier quoted context omitted.

"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text." Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed. I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing d…

To be honest, the 'bush hid the facts' bug was funny and was not really a vulnerability that could be exploited, unless... you understood Chinese and the alternative text would manage to pursuade you to do something harmful. In fact, those were the good days, when a mere affair with your secretary would be enough to jeopardize your career. The pendulum couldn't have swung more since.

> unless... you understood Chinese and the alternative text would manage to persuade you to do something harmful

Oh, here is the file I just saved... I see that it now tells me to rob a bank and donate the money to some random cult I'm just learning about.

Let me make a web search to understand how to contact the cult leader and proceed with my plan!

(luckily LLMs were not a thing back then :) )

Re: Windows Notepad App Remote Code Execution Vulnerability

#155

Post by jamespo »

dgxyz wrote: post #102
direwolf20 wrote: post #88

Earlier quoted context omitted.

Unixes like Linux are not immune.

True, as systemd and wayland point out elegantly. But at least there is a modicum of choice there.

Ironic in a post about a CVE, as systemd offers more security options for starting services than anything else.

Re: Windows Notepad App Remote Code Execution Vulnerability

#156

Post by MonkeyClub »

autoexec wrote: post #138
daemoncoder wrote: post #133

Earlier quoted context omitted.

Ability to handle email coming soon.

But can it play MP3s?

I'm sure eventually it will, it's law:

Every text editor, if it survives long enough, will end up implementing a partial, bug-ridden version of Emacs.

Re: Windows Notepad App Remote Code Execution Vulnerability

#157

Post by fwgijcqywqeo »

sph wrote: post #121
reyqn wrote: post #105

Earlier quoted context omitted.

Embarrassing bugs are not RCEs. Also the industry should be more mature now, not less. But move fast and break things, I guess...

We have reached peak software stability, it's all gonna be downhill from here.

We are living in the future!

Re: Windows Notepad App Remote Code Execution Vulnerability

#158

Post by deaux »

szszrk wrote: post #153
avaer wrote: post #86

Earlier quoted context omitted.

I 100% agree. I'm just trying to point out the problem isn't Microsoft AI slopping their software. Even if you slopped it, the software could turn out better than what they're putting out. There must be something much worse than slop going on to get to this point.

Notepad and mspaint have now copilot integration. With full authentication integration that will likely fail for people in corporate environment. That's a slop if you ask me. Even if it wasn't vibe coded, it now want's me to vibe use it. Who the hell wanted that.

It's good ole enshittification, which became common at least a decade before the term vibe coding was coined.

Re: Windows Notepad App Remote Code Execution Vulnerability

#159

Post by dspillett »

weinzierl wrote: post #59
Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text." Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed. I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing d…

> nailing down Unicode and text encodings was still considered rocket science. Now this is a solved problem

I wish…

Detecting text encoding is only easy if all you need to contend with is UTF16-with-BOM, UTF8-with-BOM, UTF8-without-BOM, and plain ASCII (which is effectively also UTF8). As soon as you might see UTF16 or UCS without a BOM, or 8-bit codepages other than plain ASCII (many apps/libs assume that these are always CP1252, a superset of the printable characters of ISO-8859-1, which may not be the case), things are not fully deterministic.

Thankfully UTF8 has largely won out over the many 8-bit encodings, but that leaves the interesting case of UTF8-with-BOM. The standard recommends against using it, that plain UTF8 is the way to go, but to get Excel to correctly load a UTF8 encoded CSV or similar you must include the BOM (otherwise it assumes CP 1252 and characters above 127 are corrupted). But… some apps/libs are completely unaware that UTF8-with-BOM is a thing at all so they load such files with the first column header corrupted.

Source: we have clients pushing & pulling (or having us push/pull) data back & forth in various CSV formats, and we see some oddities in what we receive and what we are expected to send more regularly than you might think. The real fun comes when something at the client's end processes text badly (multiple steps with more than one of them incorrectly reading UTF8 as CP1252, for example) before we get hold of it, and we have to convince them that what they have sent is non-deterministically corrupt and we can't reliably fix it on the receiving end…

Re: Windows Notepad App Remote Code Execution Vulnerability

#160

Post by bigfatkitten »

Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

> At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?"

They didn’t stop there. They also asked “does this need AI?” and came up with the wrong answer.

Post reply on HN