Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

331–340 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#331

Post by est »

bigfatkitten wrote: post #160
Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

> At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" They didn’t stop there. They also asked “does this need AI?” and came up with the wrong answer.

I think they came up the the exact right answer like:

> How do I add more features to get a promotion

Re: Windows Notepad App Remote Code Execution Vulnerability

#332

Post by Aachen »

somat wrote: post #137
dark-star wrote: post #3

Yeah, clicking unverified links in a markdown document to launch an executable.... Clicking unknown links is always a bad idea, but a CVE for that? I dunno....

I want to complain about the terminology used. It is probably just me, but RCE implies no user action required. It is a stupid, bad error yes, but because it requires the user to load a payload file and click on a link I would not really categorize it as a "remote" code execution type vulnerability. But yeah, pedantic terminology aside, what a stupid stupid error. In notepad, of all things, reading text files should…

Yes, that is the definition consistent with historical use of "RCE": a component is accessible in such a way that it is remotely reachable and you can get full code execution access on the machine via that bug (subject to whatever limits the process has within the OS, such as running as a certain user ID or seccomp or such). This attack is less like an RCE in a networked web server and more like bad file parsing in a PDF reader

Last month it was the term "supply chain attack" that was abused to describe a situation where some vulnerable dependency could be abused in a downstream component. I guess every weakness in the Linux kernel is now a "supply chain attack" because it was in the supply chain and there is an attack, never mind that the term was originally about e.g. the liblzma/xz situation (specific attacks on a supply chain component, with no other purpose than attacking a downstream vendor)

I know I can't stop language change but I am getting a bit tired of how many tech people (who know better) go along with fear term inflation

Re: Windows Notepad App Remote Code Execution Vulnerability

#333

Post by psychoslave »

bigfatkitten wrote: post #160
Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

> At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" They didn’t stop there. They also asked “does this need AI?” and came up with the wrong answer.

But can it generate qrcode already?

Re: Windows Notepad App Remote Code Execution Vulnerability

#334

Post by Ntrails »

MarleTangible wrote: post #214
usrbinbash wrote: post #184

Earlier quoted context omitted.

As funny as the "Bush hid the facts" bug may be, there is a world of difference between an embarassing mistake by a function that guesses the text encoding wrong, and a goddamn remote code execution with an 8.8 score > and we have other battles we fight. Except no, we don't. notepad.exe was DONE SOFTWARE. It was feature complete. It didn't have to change. This is not a battle that needed fighting, this was hitting a…

They also wanted to use the popularity of Notepad, so they replaced it with an AI bloatware version instead of creating a new app with extra features.

How long were they threatening to kill snipping tool despite it being a perfectly serviceable piece of kit so we could switch to some shitty alternative?

Re: Windows Notepad App Remote Code Execution Vulnerability

#335

Post by optymizer »

appreciatorBus wrote: post #320
onion2k wrote: post #245

Earlier quoted context omitted.

Because there are plenty of developers who'll say yes, so anyone saying no is putting their ethics ahead of their livelihood. Few people will be willing to put their beliefs ahead of providing for their family. It's easy to say you will, and very hard to actually do it.

You can say exactly the same thing about the management and the shareholders. If they say no, someone else will say yes, so why blame them?

Your solution for us to all agree to do the same thing is not realistic for the same reason that recycling doesn't really work, why we have a myriad of programming languages and similar but incompatible hardware, etc.

There is always someone who will take advantage of the prisoners dilemma.

Re: Windows Notepad App Remote Code Execution Vulnerability

#336

Post by Aachen »

usrbinbash wrote: post #184
weinzierl wrote: post #59

Earlier quoted context omitted.

"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text." Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed. I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing d…

As funny as the "Bush hid the facts" bug may be, there is a world of difference between an embarassing mistake by a function that guesses the text encoding wrong, and a goddamn remote code execution with an 8.8 score > and we have other battles we fight. Except no, we don't. notepad.exe was DONE SOFTWARE. It was feature complete. It didn't have to change. This is not a battle that needed fighting, this was hitting a…

I would agree if it were RCE

This definition in the first paragraph on Wikipedia matches my understanding of it as a security consultant:

> The ability to trigger arbitrary code execution over a network (especially via a wide-area network such as the Internet) is often referred to as remote code execution (RCE or RCX). --https://en.wikipedia.org/wiki/Arbitrary_code_execution

Issues in handling local files, whether they require user interaction or not, are just that

Doesn't take away from the absurdity that notepad isn't a notepad but does extensive file contents parsing

Re: Windows Notepad App Remote Code Execution Vulnerability

#337

Post by est »

dgxyz wrote: post #50
r2vcap wrote: post #37

A few days ago, Notepad++ got compromised—apparently by a state actor (or a proxy). And now, today, Windows’ built-in Notepad has a fresh CVE. What a life. At this point, what am I supposed to do other than uninstall Windows completely? No real sandboxing, a mountain of legacy…

Well technically Unixes like Linux are a mountain of legacy and they are fine. Windows is just a mountain of shit.

> a mountain of legacy and they are fine.

telnetd CVE-2026-24061. It's embarrassingly simple exploit but took years to be discovered.

> When telnetd invokes /usr/bin/login, it passes the USER value directly. If an attacker sets USER=-f root and connects using telnet -a or --login, the login process interprets -f root as a flag to bypass authentication, granting immediate root shell access.

Re: Windows Notepad App Remote Code Execution Vulnerability

#338

Post by bsza »

vel0city wrote: post #307
bsza wrote: post #298

Earlier quoted context omitted.

What counts as "large"? I'm pretty sure at some point in my life I'd opened the entirety of Moby Dick in Notepad. Unless you want to look for text in a binary file (which Notepad definitely isn't for) I doubt you'll run into that problem too often. Also, I hope the irony of you citing Notepad++ [1] as what Notepad should aim to be isn't lost on you. My point being, these kinds of vulnerabilities shouldn't exist in a…

> What counts as "large"? Remote into a machine that you're not allowed to copy data out of. You only have the utilities baked into Windows and whatever the validated CI/CD process put there. You need to open a log file that has ballooned to at least several hundred megabytes, maybe more. Moby Dick is about 1MB of text. That's really not much compared to a lot of log files on pretty hot servers. I do agree though, if…

Oh right, generated files exist. Though logging systems usually have a rollover file size you can configure, should this happen to you in real life.

Honestly I'm okay with having to resort to power tools for these edge cases. Notepad is more for the average user who is less likely to run into 100 MB text files and more likely to run into a 2 kB text file someone shared on Discord.

Re: Windows Notepad App Remote Code Execution Vulnerability

#339

Post by TZubiri »

oblio wrote: post #180
TZubiri wrote: post #145

Earlier quoted context omitted.

>Why does every Linux distro under the sun try so hard to protect the garbage under /usr/bin/ and /etc Because a compromised user could infect shared executables and spread the infection. A bit harder to do with etc but for sure possible. The main target would be infecting bash and you are done from the get go. >when literally the only files that matter to me are in /home, which is a free-for-all? The home folder's r…

> when literally the only files that matter to me are in /home, which is a free-for-all? > The home folder's read write is usually restricted to the user. Yeah, and that is the point. All user's programs including curl, wget, the web browser, anything else that connects to the network run as the user, and all the user's programs, by default, have access to everything inside ${HOME}. Most people don't really care if /…

Just make another user bro. If you can't even create a user to run a program you distrust, the issue is not that windows doesn't provide sandboxes, it's that you don't use them

And no, it's not "a lot of work" it's the bare minimum

Re: Windows Notepad App Remote Code Execution Vulnerability

#340

Post by TZubiri »

amlib wrote: post #291
Baerbeisser wrote: post #265

Earlier quoted context omitted.

There's still old tiny Metapad. And also more modern and fully featured (but still light) Notepad 2/3/4 and Notepad++. For full replacement, i just renamed all instances to notepad.exe.bak, back then on Windows 7 & 10, and rename-replaced it with metapad.exe. Though, i guess with UWP apps (modern Notepad is one), it's just file associations nowadays. There's surely some mass-reassociate utility around? Btw, nano is o…

If he learns vim... gasp ...he will be cursed with having to install vim in every machine he touches for the rest of his life! :)

It usually comes with linux, but nano is simpler and it doesn't teach you by holding you hostage until you learn :q!
Post reply on HN