Hacker News Reader

Comment by falcor84 | Hacker News Reader

Wow! At first sight I was sure it was a joke, but no. What a time...

https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

Presumably this is like many other graphics tool vulnerabilities this works by the attacker persuading a user to open a file that exercises the bug. Not terribly unusual.

I don't think so:

> User Interaction: None

> Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.

> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network.

What server is MS Paint running or what services does it provide?

Edit: Apparently you can use it to print an image from the command-line. Is that how this is being exploited?

IIS (Internet Impasto Server)

MS Paint has Copilot now

Does that turn it into a server or service?

I'm no expert but so much of Windows is implemented as services. svchost.exe is probably involved somehow. Like it wouldn't surprise me if Copilot is implemented as a service and it talks to Paint via IPC messages or something

But that alone wouldn't make the service listen on the network, even if it were the case.

It would make sense that it could listen for messages like "your generated image is ready!" and pass bitmap data to Paint. And media like images are a common source of vulnerabilities since you're basically passing binary data into the software.

This site doesn't do jokes

Not to imply any particular comparison to less serious websites where the karma system over time may have resulted in a disproportionate surplus of one liner jokes and other spammy low quality posts.

At least not about serious security matters

This site absolutely does jokes, it just doesn't beat horses into bloody pulps with the jokes the way reddit does. We have a higher standard. A joke has to actually be funny, and not some tired reference.

Except for the infamous Dropbox comment.

Post a thread including the number "42" in the title, and you'll be proven wrong in the first 3 comments.

When they find a CVE RCE in minesweeper then you know it’s all over

Turns out we were sweeping for CVEs, not mines, all along

Does windows even have minesweeper anymore

Yes, and it's 200+ MB: https://news.ycombinator.com/item?id=40647278

Still able to happily play rounds of Minesweeper on my 286-16!

Not out of the box.

Of course the valuable link is down-weighted/buried in the HN discussion...

  >Publicly disclosed
  >No

  >Exploited
  >No

  >Exploitability assessment
  >Exploitation Less Likely

Reply on news.ycombinator.com