331–340 of 407 posts
Pretty unimpressive as security vulnerabilities. It would be better to just say these are simple bugs for the most part.
I disagree. That FFmpeg code execution is absolutely nasty
Earlier quoted context omitted.
> a flurry of this sort of stuff as the AIs get smart enough to find them. I really think this characterization is misleading. It's not "getting smart", only more tailored toward a specific usage, better curated dataset, better harness, better prompts, better labeling of results, documentation of failures and success, etc. The outcome is (hopefully) overall better but this anthropomorphized wording makes it sound lik…
Do you have a definition of "smart" such that there is something an AI could do to prove itself intelligent? Or are you just defining "fast" as something only horses can do, and considering that a useful insight about cars?
I took a look at the Ghidra ones (because I use Ghidra), and I'm unimpressed: https://github.com/bikini/exploitarium/blob/main/ghidra-12.1... The first requires being able to overwrite binaries in the Swift tool directory. Yes, if you overwrite binaries executed by ghidra, you can trigger code execution. This is not a surprise. The second, idk, I'm not familiar with TraceRMI (but it's probably worth noting that "RMI"…
code execution js code execution, if reached through some bug or executing code that was not intended to be executed its bad, even if the mechanism is kind of obvious and trivial, it still can lead to unexpected code to be launched.
the repo also notes low quality of some POC like ones you noted.
its correct to be a bit wary and i wouldnt call it some crazy 0day dropping account or anything, but bugs/vulns are bugs an vulns and simply because you are not impressed by their complexity, it does not reduce them entirely. just makes em lil less scary.
the ghidra one, it reminds of things like unquoted service paths in windows services. its a silly thing and clearly its bad but it still happens and gets companies pwned :'). a lot of companies use ghidra actively and if you imagine what kind, you'd hope they will not allow the overwriting of those swift binaries ;p. some pentester bound to have a laugh.
0-days-vibes-vulns ? There should be a new category, for spotting and handling the em-dashes of this brave new world of vulns and making the old fossils like me only picking my head up for the old painfully still hand-crafted artisanal ones instead. A kind of label, like free-range for eggs, in sum.
Yes, big pet peeve of the new world. Every em dash is apparently an AI trigger. Back in my day, they were a sign of great respect within my people.
I took a look at the Ghidra ones (because I use Ghidra), and I'm unimpressed: https://github.com/bikini/exploitarium/blob/main/ghidra-12.1... The first requires being able to overwrite binaries in the Swift tool directory. Yes, if you overwrite binaries executed by ghidra, you can trigger code execution. This is not a surprise. The second, idk, I'm not familiar with TraceRMI (but it's probably worth noting that "RMI"…
Ah, MS07-052[1] ("code execution leads to code execution") strikes again. These sorts of "if you allow arbitrary code to be executed, code will be executed" "vulnerability" reports seem evergreen
[1]: https://devblogs.microsoft.com/oldnewthing/20070807-00/?p=25...
Earlier quoted context omitted.
Was just thinking it would be hilarious if these were all known CVEs hiding the next Shai-Hulud inside of them and waiting to compromise security hobbyists rushing to download them.
The design purpose of Windows Sandbox :)
I very briefly considered doing something like this: if I just post the results on the internet, people can crowdsource filing issues and working on fixes. It's certainly not the nicest way of doing this, but on balance I'd like these issues to be fixed eventually.
I ended up not doing that and am instead filing a couple issues a day because it's not that much of a burden. This was an experiment that was much more successful than I expected, so I didn't budget to spend this time, but it's also not a huge deal to slowly do it.