Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

241–250 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#241

Post by dgxyz »

oblio wrote: post #180
TZubiri wrote: post #145

Earlier quoted context omitted.

>Why does every Linux distro under the sun try so hard to protect the garbage under /usr/bin/ and /etc Because a compromised user could infect shared executables and spread the infection. A bit harder to do with etc but for sure possible. The main target would be infecting bash and you are done from the get go. >when literally the only files that matter to me are in /home, which is a free-for-all? The home folder's r…

> when literally the only files that matter to me are in /home, which is a free-for-all? > The home folder's read write is usually restricted to the user. Yeah, and that is the point. All user's programs including curl, wget, the web browser, anything else that connects to the network run as the user, and all the user's programs, by default, have access to everything inside ${HOME}. Most people don't really care if /…

Backups FTW.

Re: Windows Notepad App Remote Code Execution Vulnerability

#243

Post by skydhash »

xnorswap wrote: post #90
larodi wrote: post #65

use SublimeText, it is perhaps faster now than the stock Notepad

As much as I used to love Sublime, the version switching caught me out which burned me a bit, even if admittedly my v2 key lasted an unreasonable time through the version 3 beta, but I don't want to risk buying a v4 key without a clear roadmap of when they might switch to version 5.

It’s $99 for something that is almost 5 years old at that point.

Re: Windows Notepad App Remote Code Execution Vulnerability

#244

Post by jasonjayr »

setopt wrote: post #84
SomeUserName432 wrote: post #75

Earlier quoted context omitted.

I find notepad useful for sanitising clipboard content. No bold text, italics, bullet points, invisible html.. Just get the text and can copy it to paste again somewhere else. Ala Cmd+Shift+V on Mac

I somewhat regularly use the almost embarrassing key sequence Ctrl-C Ctrl-L Ctrl-V Ctrl-A Ctrl-X to sanitize text I’ve copied from a browser, using the address field to remove any formatting.

This reminds me of the 'spacebar heating' xkcd: https://xkcd.com/1172/

Re: Windows Notepad App Remote Code Execution Vulnerability

#245

Post by onion2k »

wormpilled wrote: post #240
cyanydeez wrote: post #192

Earlier quoted context omitted.

Microsoft is driving AI adoption. Why blame tge workers for this?

Why can't Indian software developers stand up for themselves and say no?

Because there are plenty of developers who'll say yes, so anyone saying no is putting their ethics ahead of their livelihood. Few people will be willing to put their beliefs ahead of providing for their family.

It's easy to say you will, and very hard to actually do it.

Re: Windows Notepad App Remote Code Execution Vulnerability

#246

Post by gcr »

mjmas wrote: post #134

It is to do with link handling: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... > An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

What does “unverified protocols” mean? Does Windows have an exe:// url scheme that fetches and runs executable binaries or something?

Re: Windows Notepad App Remote Code Execution Vulnerability

#247

Post by [deleted] »

onion2k wrote: post #245
wormpilled wrote: post #240

Earlier quoted context omitted.

Why can't Indian software developers stand up for themselves and say no?

Because there are plenty of developers who'll say yes, so anyone saying no is putting their ethics ahead of their livelihood. Few people will be willing to put their beliefs ahead of providing for their family. It's easy to say you will, and very hard to actually do it.

[deleted]

Re: Windows Notepad App Remote Code Execution Vulnerability

#248

Post by michaelsshaw »

karel-3d wrote: post #212
r2vcap wrote: post #37

A few days ago, Notepad++ got compromised—apparently by a state actor (or a proxy). And now, today, Windows’ built-in Notepad has a fresh CVE. What a life. At this point, what am I supposed to do other than uninstall Windows completely? No real sandboxing, a mountain of legacy…

Visual Studio Code was not compromised.

Neither is Neovim, Sublime Text, Visual Studio, ed, etc... So what? This is still unacceptable

Re: Windows Notepad App Remote Code Execution Vulnerability

#249

Post by gruez »

Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

>At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?"

But so far as I can tell the bug isn't related to "network-aware rendering stack" or AI (as other people are blindly speculating)?

From MSRC:

>How could an attacker exploit this vulnerability?

>An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

Sounds like a bug where you could put an url like \\evil.example\virus.exe into a link, and if a user clicks it executes virus.exe

Re: Windows Notepad App Remote Code Execution Vulnerability

#250

Post by OptionOfT »

silon42 wrote: post #207
josephg wrote: post #185

Earlier quoted context omitted.

> to get Excel to correctly load a UTF8 encoded CSV or similar you must include the BOM Ah so that’s the trick! I’ve run into this problem a bunch of times in the wild, where some script emits csv which works on the developers machine but fails strangely with real world data. Good to know there’s a simple solution. I hope I remember your comment next time I see this!

Excel CSV is broken anyway, since in some (EU, ...) countries it needs ; as separator.

That's not an excel issue. That's a locale issue.

Due to (parts of?) the EU using then comma as the decimal separator, you have to use another symbol to separate your values.

Post reply on HN