Stories
Slash Boxes
Comments

SoylentNews is people

Microsoft Modifies Open-Source Code, Blows Hole in Windows Defender

posted by chromas on Monday April 09 2018, @06:12PM   Printer-friendly
from the (unsigned⠀int) dept.

mrpg writes:

https://www.theregister.co.uk/2018/04/04/microsoft_windows_defender_rar_bug/

A remote-code execution vulnerability in Windows Defender – a flaw that can be exploited by malicious .rar files to run malware on PCs – has been traced back to an open-source archiving tool Microsoft adopted for its own use.

[...] Apparently, Microsoft forked that version of unrar and incorporated the component into its operating system's antivirus engine. That forked code was then modified so that all signed integer variables were converted to unsigned variables, causing knock-on problems with mathematical comparisons. This in turn left the software vulnerable to memory corruption errors, which can crash the antivirus package or allow malicious code to potentially execute.

Original Submission

 
This discussion has been archived. No new comments can be posted.
Microsoft Modifies Open-Source Code, Blows Hole in Windows Defender | Log In/Create an Account | Top | 85 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 4, Informative) by DannyB on Monday April 09 2018, @08:53PM (1 child)

    by DannyB (5839) Subscriber Badge on Monday April 09 2018, @08:53PM (#664671) Journal

    It was Ballmer (developers, Developers, DEVELOPERS!!!, I Love This Monopoly!!!) who said that Linux was a Cancer.

    It was Jim Allchin (who was #4 at Microsoft, at that time, long before Vista) who said effectively that Open Source is un-American and we need to educate the legislators to the danger.

    --
    To transfer files: right-click on file, pick Copy. Unplug mouse, plug mouse into other computer. Right-click, paste.
    Starting Score:    1  point
    Moderation   +2  
       Interesting=1, Informative=1, Total=2
    Extra 'Informative' Modifier   0  
    Karma-Bonus Modifier   +1  
    Total Score:   4  

  • (Score: 4, Informative) by boltronics on Tuesday April 10 2018, @11:13AM

    by boltronics (580) on Tuesday April 10 2018, @11:13AM (#664885) Homepage Journal

    The Halloween Documents exposed Microsoft's FUD tactics back in '98. That's long before XP. Long before Windows ME. That's even before Windows 98 SE was a thing.
    http://catb.org/esr/halloween/ [catb.org]
    https://en.wikipedia.org/wiki/Halloween_documents [wikipedia.org]

    --
    It's GNU/Linux dammit!