Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

231–240 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#231

Post by Someone1234 »

mr_mitm wrote: post #74
Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

Unfortunately, code execution in text editors aren't a new thing. Vim had one published in 2019: https://github.com/numirias/security/blob/master/doc/2019-06... Another in 2004: https://www.cve.org/CVERecord?id=CVE-2002-1377 Neither vim nor Notepad are purely for displaying text though.

> Neither vim nor Notepad are purely for displaying text though.

Up until fairly recently, that's exactly all Notepad did.

Vim has those bugs because of bloat, and now Notepad does too. AI, Markdown, Spellchecker, etc, nobody asked for this bloat.

Re: Windows Notepad App Remote Code Execution Vulnerability

#232

Post by skydhash »

oblio wrote: post #180
TZubiri wrote: post #145

Earlier quoted context omitted.

>Why does every Linux distro under the sun try so hard to protect the garbage under /usr/bin/ and /etc Because a compromised user could infect shared executables and spread the infection. A bit harder to do with etc but for sure possible. The main target would be infecting bash and you are done from the get go. >when literally the only files that matter to me are in /home, which is a free-for-all? The home folder's r…

> when literally the only files that matter to me are in /home, which is a free-for-all? > The home folder's read write is usually restricted to the user. Yeah, and that is the point. All user's programs including curl, wget, the web browser, anything else that connects to the network run as the user, and all the user's programs, by default, have access to everything inside ${HOME}. Most people don't really care if /…

Protecting a user from himself is hard. Protecting user from others is easy. Linux is influenced by unix and a lot of installations are servers. Where most programs run under their own accounts.

You can always have two user accounts: oblio and unsafe-oblio anf have a shared folder between the two for transferring files. Or invest into some backup software.

Re: Windows Notepad App Remote Code Execution Vulnerability

#233

Post by joshuaissac »

keepamovin wrote: post #67
Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

I couldn't agree more. A text editor exposing an attack surface via a network stack is precisely the kind of bloat that makes modern computing ultra-fragile. I actually built a "dumb" alternative in Rust last week specifically to escape this. It’s a local-only binary—no network permissions, encrypted at rest, and uses FIPS-compliant bindings (OpenSSL) just to keep the crypto boring and standard. It’s inspectable if y…

> FIPS-compliant bindings (OpenSSL)

Using FIPS mode can be insecure because the latest FIPS-compliant version can be years older than the latest non-FIPS one with all the updates.

The only time it makes sense to use the FIPS version is where there is a legal or contractual requirement that trumps security considerations.

Re: Windows Notepad App Remote Code Execution Vulnerability

#235

Post by gchamonlive »

b3lvedere wrote: post #217
gchamonlive wrote: post #161

Earlier quoted context omitted.

> What more does notepad need? AI! It needs AI. Did I guess it right?

Affermative. You have unlocked the following achievement: "Get a head start of 45 minutes when we start destroying humanity".

Since there'll be nowhere to run, could I be one the first? Don't wanna have to deal with the hassle of having to watch my loved ones being chased down.

Re: Windows Notepad App Remote Code Execution Vulnerability

#236

Post by Someone1234 »

Hackbraten wrote: post #191
BLKNSLVR wrote: post #182

Earlier quoted context omitted.

> It is to do with link handling: Notepad? Link handling? That's like my pencil having a CVE that's to do with how it loads the ink. That old saying about 'if Microsoft built a car' is more true now than it was then: https://www.snopes.com/fact-check/car-balk/

Unpopular opinion: rudimentary Markdown support is not entirely far-fetched even for a dumb text editor. Even though I’m all against feature bloat, I think that making Markdown hyperlinks clickable is still within the Overton window of what a simple editor should be doing.

You cannot claim you're "against feature bloat" while then in the same breath say that it is acceptable that a basic text editor have an entire additional render pipeline.

If you want Markdown use VSCode, it is a first class citizen. Don't take an intentionally stripped down text editor and bolt on VSCode-like features.

Re: Windows Notepad App Remote Code Execution Vulnerability

#237

Post by whatsupdog »

sneak wrote: post #166
bigfatkitten wrote: post #160

Earlier quoted context omitted.

> At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" They didn’t stop there. They also asked “does this need AI?” and came up with the wrong answer.

It’s just resumé driven development. Corporate droids gotta justify their salaries somehow. It doesn’t pay to call software “done”.

Unjustified downvoting. You absolutely have a point. Not just software, also the gazillion UI/UX designers. They keep moving things around and changing colors and fucking things up just to justify their salaries. Case in point: Google maps. It was perfect 15 years ago. We don't need vomit inducing color changes every 2 years

Re: Windows Notepad App Remote Code Execution Vulnerability

#238

Post by Someone1234 »

voidUpdate wrote: post #52
mdavid626 wrote: post #31

Earlier quoted context omitted.

I extracted out notepad.exe, calc.exe and mspaint.exe from Windows 7. I use them on Windows 11. They work perfectly.

I have the mspaint.exe from the same version too :P. It complains about registry stuff on launch but other than that it works fine. There's no spray can in the modern paint!

They also added strange hacked on half-support for alpha-transparency in modern MS Paint. Meaning there is an alpha layer, and imported staff may utilize it, but if you need to do anything with that layer, you're basically SOL.

Better to have no alpha-transparency than whatever this is. At least old Paint just turned it white, and you could manipulate the white layer, with this working with the alpha layer is a nightmare.

Re: Windows Notepad App Remote Code Execution Vulnerability

#239

Post by skydhash »

w4yai wrote: post #117
ddtaylor wrote: post #99

Earlier quoted context omitted.

Do you have a moment to talk about Linux?

Half of my software don't work on Linux. My job also depends on running PE in a legitimate (read not Wine) environment - and I don't want to spend half of my RAM running VMs. What should I do ?

Multiple computers. I have an MBA for whenever I need to do a meeting or do online shopping. But my personal usage (95%) happens on openbsd. Work provides a MBP that only has work stuff and only opened between work hours.

Re: Windows Notepad App Remote Code Execution Vulnerability

#240

Post by wormpilled »

cyanydeez wrote: post #192
sneak wrote: post #166

Earlier quoted context omitted.

It’s just resumé driven development. Corporate droids gotta justify their salaries somehow. It doesn’t pay to call software “done”.

Microsoft is driving AI adoption. Why blame tge workers for this?

Why can't Indian software developers stand up for themselves and say no?
Post reply on HN