Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opening *.txt file is dangerous on Windows

technet.microsoft.com

Post reply on HN
Print view View original

31–40 of 52 posts

Re: Opening *.txt file is dangerous on Windows

#31

Post by EllieAsksWhy »

recoiledsnake wrote: post #28

It is not dangerous if you install the update. Why is the headline hyping it as if it's an unpatched zero day?

Sigh, agreed. The Microsoft TechNet article in the link is dated 13 September 2011. AND it says that this is no longer a problem for users who installed the update, issued several days ago! So yes, this is a very misleading headline.

Regarding the content of the security advisory, it specifically says THIS (although the WebDAV site details are there after quite a bit of digging around):

"The vulnerability could allow remote code execution if a user opens a legitimate rich text format file (.rtf), text file (.txt), or Word document (.doc) that is located in the same network directory as a specially crafted dynamic link library (DLL) file. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user."

Re: Opening *.txt file is dangerous on Windows

#32

Post by kevingadd »

LeafStorm wrote: post #30
Vivtek wrote: post #22

Earlier quoted context omitted.

I'm guessing it's actually a bug with Explorer (that is, the actual opening action) than any particular editor, since RTF files are also affected - and doubtlessly many other file types.

It's not Explorer, it's a bug with the Win32 API that loads DLLs. Any program that uses Win32 to load libraries is affected.

Not true, see here:

http://msdn.microsoft.com/en-us/library/ms682586%28v=vs.85%2...

The vulnerability, as I understand it (I did a little research by examining one of the vulnerable applications), since we don't have any actual PoCs to examine:

notepad.exe, like many of the stock Windows apps, uses a bunch of system libraries. One of those system libraries loads shdocvw.dll (an Internet Explorer related component). shdocvw.dll has a delay-load dependency on a library called 'ieshims.dll'. On my computer, when I start notepad.exe, shdocvw.dll tries to load ieshims.dll, and fails, but continues normally.

This means that since ieshims.dll is not found in the app directory or the windows system directory, the search for it will continue all the way into the current working directory, which would make it possible for an exploit to put a payload in an 'ieshims.dll' stored in the current working directory (next to the .txt file), and it would then be loaded.

Assuming my research is correct, this looks like a security vulnerability introduced by one of the Internet Explorer developers, probably for some sort of compatibility purpose. They ignored the fact that IE is used as a component in many system applications, and basically added a vulnerability to every app using shdocvw (there are a lot of them).

Re: Opening *.txt file is dangerous on Windows

#35

Post by forcefsck »

peterwwillis wrote: post #23

The report says this vulnerability is specific to remote network shares and WebDAV. All you have to do is send someone a link to a .txt file on a WebDAV site with a .dll in the same directory, I guess, and they'll be owned... That is pretty awesome. (As was commented on below, this is identical to an LD_LIBRARY_PATH type exploit on Linux; here is Microsoft's fix as well as an explanation of how it works http://suppor…

Except that LD_LIBRARY_PATH is not a type of exploit and shouldn't be mentioned as such.

Re: Opening *.txt file is dangerous on Windows

#36

Post by JoachimSchipper »

baddox wrote: post #16
nollidge wrote: post #5

Earlier quoted context omitted.

I wonder if Notepad, Wordpad, and maybe Word all call some library (or all have copy/pasted code) that, for whatever reason, looks for a particular DLL in the working folder and executes it? Not sure how the network drive part would fit into that hypothesis, though.

The article doesn't mention it, but does anyone know if a requirement to reproduce the vulnerability is that the files be opened in Notepad, Wordpad, or Word? What if you used a third-party editor?

It's a generic vulnerability; any program that loads DLLs while the current directory is untrusted has the same problem.

Re: Opening *.txt file is dangerous on Windows

#39

Post by dfranke »

bricestacey wrote: post #26
dfranke wrote: post #12

Earlier quoted context omitted.

Unless you have an exceptionally paranoid workplace, a much easier way to compromise your boss's computer is just to walk over to it and pop in a livecd after he's gone home for the day.

While I generally agree (even though it's locked doors all the way up for me and there are even easier ways I could compromise machines), it's foolish to disregard remote code execution vulnerabilities just because physical access is not secured.

Oh, I certainly agree. But I only agree because my threat model includes adversaries other than malicious coworkers; particularly, it includes innocent coworkers with malware-infected workstations.

By the way, ten minutes I wrote the grandparent to this comment, a coworker IMed me and asked me to break into his workstation :-). He was working remotely, trying to SSH in, his system had gotten wedged due to what turned out to be disk errors, and he needed me to rescue it.

Re: Opening *.txt file is dangerous on Windows

#40

Post by Kliment »

forcefsck wrote: post #35
peterwwillis wrote: post #23

The report says this vulnerability is specific to remote network shares and WebDAV. All you have to do is send someone a link to a .txt file on a WebDAV site with a .dll in the same directory, I guess, and they'll be owned... That is pretty awesome. (As was commented on below, this is identical to an LD_LIBRARY_PATH type exploit on Linux; here is Microsoft's fix as well as an explanation of how it works http://suppor…

Except that LD_LIBRARY_PATH is not a type of exploit and shouldn't be mentioned as such.

Not in itself, but if you can manage to change it for someone without their awareness you have basically tricked them into running arbitrary (local) code.
Post reply on HN