Stories
Slash Boxes
Comments

SoylentNews is people

Microsoft Modifies Open-Source Code, Blows Hole in Windows Defender

posted by chromas on Monday April 09 2018, @06:12PM   Printer-friendly
from the (unsigned⠀int) dept.

mrpg writes:

https://www.theregister.co.uk/2018/04/04/microsoft_windows_defender_rar_bug/

A remote-code execution vulnerability in Windows Defender – a flaw that can be exploited by malicious .rar files to run malware on PCs – has been traced back to an open-source archiving tool Microsoft adopted for its own use.

[...] Apparently, Microsoft forked that version of unrar and incorporated the component into its operating system's antivirus engine. That forked code was then modified so that all signed integer variables were converted to unsigned variables, causing knock-on problems with mathematical comparisons. This in turn left the software vulnerable to memory corruption errors, which can crash the antivirus package or allow malicious code to potentially execute.

Original Submission

 
This discussion has been archived. No new comments can be posted.
Microsoft Modifies Open-Source Code, Blows Hole in Windows Defender | Log In/Create an Account | Top | 85 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 0) by Anonymous Coward on Monday April 09 2018, @08:50PM (8 children)

    by Anonymous Coward on Monday April 09 2018, @08:50PM (#664669)

    a flaw that can be exploited by malicious .rar files to run malware on PCs – has been traced back to an open-source archiving tool Microsoft adopted for its own use.

    [...] Apparently, Microsoft forked that version of unrar and incorporated the component into its operating system's antivirus engine.

    Unrar is not open source and as far as I know it never was. It is distributed under a proprietary license with significant restrictions on usage and modifications.

  • (Score: 0) by Anonymous Coward on Monday April 09 2018, @09:06PM (1 child)

    by Anonymous Coward on Monday April 09 2018, @09:06PM (#664676)

    License:
        https://www.win-rar.com/winrarlicense.html [win-rar.com]

    Looks like unrar may be a bit different from rar (and gui version winrar), since there is the mention of source for unrar??
    IANAL...

    • (Score: 0) by Anonymous Coward on Monday April 09 2018, @09:21PM

      by Anonymous Coward on Monday April 09 2018, @09:21PM (#664686)

      That's not the unrar license, although it includes parts of it. A web search turned up this copy of the license text [fedoraproject.org], which matches what is found in tar file you can download from rarlab.com.

      Note that there are actual free unpackers for the RAR formats (e.g., libarchive) so there is no reason to use the proprietary unrar.

  • (Score: 2) by DannyB on Monday April 09 2018, @09:13PM

    by DannyB (5839) Subscriber Badge on Monday April 09 2018, @09:13PM (#664683) Journal

    Shhhhhh! If unrar isn't open source, how will Microsoft be able to bad mouth open source?

    --
    To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.

  • (Score: 1, Interesting) by Anonymous Coward on Monday April 09 2018, @09:41PM (1 child)

    by Anonymous Coward on Monday April 09 2018, @09:41PM (#664697)

    From the source code:

    2. UnRAR source code may be used in any software to handle
                RAR archives without limitations free of charge, but cannot be
                used to develop RAR (WinRAR) compatible archiver and to
                re-create RAR compression algorithm, which is proprietary.
                Distribution of modified UnRAR source code in separate form
                or as a part of other software is permitted, provided that
                full text of this paragraph, starting from "UnRAR source code"
                words, is included in license, or in documentation if license
                is not available, and in source code comments of resulting package.

    Might be perfectly legal, if you have good lawyers, because the license says "may be used [to open rar archives] without limitations free of charge" and restricting people from changing your source is such a restriction.

    • (Score: 0) by Anonymous Coward on Tuesday April 10 2018, @03:51AM

      by Anonymous Coward on Tuesday April 10 2018, @03:51AM (#664815)

      That doesn't sound like FOSS. That's proprietary with access to source code.

      So people, beginning with Microsoft, lay all the blame for Microsoft's screw-up on FOSS, when the code wasn't even FOSS to begin with? Typical.

  • (Score: 3, Interesting) by FatPhil on Monday April 09 2018, @11:05PM (2 children)

    by FatPhil (863) <{pc-soylent} {at} {asdf.fi}> on Monday April 09 2018, @11:05PM (#664734) Homepage
    It's not "Open Source", even if it is "open source". Having said that, "Open Source" is a bit messed up, and unrar's a bit messed up and it's possible that the messes overlap. Unrar may have restrictions on usage, but the problem is that it doesn't have enough restrictions on modifications. If it obliged you to keep the source open, and distribute it with any modifications, then this bug could have fallen to the many eyes solution years back. But no, it's closed source now - all we've got is a crappy disassemly to work with.

    This is what RMS keeps saying - the more-free licenses are worse, as they permit others to take desirable rights away.
    --
    Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves

    • (Score: 0) by Anonymous Coward on Tuesday April 10 2018, @02:17PM (1 child)

      by Anonymous Coward on Tuesday April 10 2018, @02:17PM (#664946)

      Nobody who cares about free software gives two shits about Unrar's license being "too permissive".

      Unrar is proprietary and Windows Defender is proprietary and both are bad.

      TFA (quoting Google's Tavis Ormandy) calls unrar "open source" which is simply wrong.

      • (Score: 2) by FatPhil on Wednesday April 11 2018, @07:15PM

        by FatPhil (863) <{pc-soylent} {at} {asdf.fi}> on Wednesday April 11 2018, @07:15PM (#665484) Homepage
        > Nobody who cares about free software gives two shits about Unrar's license being "too permissive".

        RedHat do (URL posted elsewhere by elsewho).
        --
        Great minds discuss ideas; average minds discuss events; small minds discuss people; the smallest discuss themselves