Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

121–130 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#121

Post by sph »

reyqn wrote: post #105
weinzierl wrote: post #59

Earlier quoted context omitted.

"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text." Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed. I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing d…

Embarrassing bugs are not RCEs. Also the industry should be more mature now, not less. But move fast and break things, I guess...

We have reached peak software stability, it's all gonna be downhill from here.

Re: Windows Notepad App Remote Code Execution Vulnerability

#122

Post by josh3736 »

leduyquang753 wrote: post #32
voidUpdate wrote: post #26

I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too

> (though the "about notepad" dialog shows the windows 11 version for some reason??) It's because the program just calls a Windows API to display the version dialog of Windows itself.

Specifically, ShellAbout: https://learn.microsoft.com/en-us/windows/win32/api/shellapi...

Re: Windows Notepad App Remote Code Execution Vulnerability

#123

Post by UqWBcuFx6NV4r »

sheiyei wrote: post #111
xnorswap wrote: post #78

Earlier quoted context omitted.

You can Ctrl+shift+v to paste plain text in windows.

In some cases. In others, the application does whatever it wants.

And funnily enough, Office for Mac doesn’t allow you to do this, or at least it didn’t used to. I think I may’ve just noticed that it’s started working.

Re: Windows Notepad App Remote Code Execution Vulnerability

#124

Post by keepamovin »

Muromec wrote: post #100
keepamovin wrote: post #67

Earlier quoted context omitted.

I couldn't agree more. A text editor exposing an attack surface via a network stack is precisely the kind of bloat that makes modern computing ultra-fragile. I actually built a "dumb" alternative in Rust last week specifically to escape this. It’s a local-only binary—no network permissions, encrypted at rest, and uses FIPS-compliant bindings (OpenSSL) just to keep the crypto boring and standard. It’s inspectable if y…

What does notepad need openssl for?

Encryption at rest (AES-GCM).

To meet FIPS 140-3, I can't roll my own crypto; I have to use a validated module.

I actually only link OpenSSL on Linux, and then only if it's in FIPS-mode. On Windows (CNG) and macOS (CoreCrypto), I use the native OS primitives to avoid the dependency and keep the binary small.

Re: Windows Notepad App Remote Code Execution Vulnerability

#125

Post by [deleted] »

g947o wrote: post #93
weinzierl wrote: post #59

Earlier quoted context omitted.

"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text." Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed. I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing d…

I am pretty sure it's possible to fix that entire category of bugs without introducing RCE vulnerabilities.

[deleted]

Re: Windows Notepad App Remote Code Execution Vulnerability

#126

Post by barosl »

xnorswap wrote: post #81
tosti wrote: post #19

Earlier quoted context omitted.

This was already better when the latest from MS was still called "* XP": https://liquidninja.com/metapad/

Wow that's a hit of nostalgia, I'd completely forgotten about metapad, but I loved it back in the day. And it's hard to believe now, but yes, support for Ctrl+S to save file was a notable feature because notepad itself didn't support that back then.

Oh wow, yes I remember now, I used to type `Alt+F` and then `S` immediately because Notepad didn't support `Ctrl+S` back then. Thanks for giving me nostalgia!

Re: Windows Notepad App Remote Code Execution Vulnerability

#127

Post by phatfish »

core1024 wrote: post #115

It looks like, after Microsoft discontinued WordPad, they want to implement more features into Notepad. If you want simple plain text editor you have to use msedit[1]. [1] https://github.com/microsoft/edit

You can still open the real notepad, you just have to turn off a "feature" that makes running notepad.exe open the new notepad. Its called "execution alias" or something like that.

Re: Windows Notepad App Remote Code Execution Vulnerability

#128

Post by zabzonk »

pjmlp wrote: post #69
TonyTrapp wrote: post #38

Earlier quoted context omitted.

Win9x Notepad in particular can only load files up to 64KB in size (edit: and supports only ANSI encoding, no Unicode). There were some actually useful additions to it up until Windows 10 or so - for example being able to handle LF (in addition to CRLF) line endings. But yeah, everything added in Windows 11 is just pure bloat.

The reason being it is a plain text edit component, with a window around it, hence the limitation.

Yep. Back when I used to teach Windows programming in C commercially, the course exercise was to replicate notepad. It was surprising how many of its features you could implement in a week-long course, especially as many of our clients were no great shakes at C.

Re: Windows Notepad App Remote Code Execution Vulnerability

#129

Post by LiamPowell »

fhd2 wrote: post #119
netsharc wrote: post #13

> An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files. From https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... (there are many collapsible elements on this page, and they're also just for term definitions, sigh) What a fucking terrible page for someone unfamiliar w…

> Anyway, it's not related to CoPilot, but because Notepad makes links clickable now... True, not related to CoPilot, but if I understand your conclusion right (which I'm not sure about), it's not _just_ that links are clickable now, it's because Notepad actually does something with the links. Otherwise it'd be a browser vulnerability, and Notepad couldn't seriously be blamed.

It's in fact the opposite. Browsers show a popup that asks if you really intended to click a link with a non http/https handler, notepad does not.

The actual RCE here would be in some other application that registers a URL handler. Java used to ship one that was literally designed to run arbitrary code.

Post reply on HN