SoylentNews

Microsoft Modifies Open-Source Code, Blows Hole in Windows Defender

posted by chromas on Monday April 09 2018, @06:12PM   
from the (unsigned⠀int) dept.

mrpg writes:

https://www.theregister.co.uk/2018/04/04/microsoft_windows_defender_rar_bug/

A remote-code execution vulnerability in Windows Defender – a flaw that can be exploited by malicious .rar files to run malware on PCs – has been traced back to an open-source archiving tool Microsoft adopted for its own use.

[...] Apparently, Microsoft forked that version of unrar and incorporated the component into its operating system's antivirus engine. That forked code was then modified so that all signed integer variables were converted to unsigned variables, causing knock-on problems with mathematical comparisons. This in turn left the software vulnerable to memory corruption errors, which can crash the antivirus package or allow malicious code to potentially execute.

---

Original Submission

• Re:...and anti-virus as a concept... Re:...and anti-virus as a concept... (Score: 1, Insightful) by Anonymous Coward on Tuesday April 10 2018, @07:37AM (1 child)

  by Anonymous Coward on Tuesday April 10 2018, @07:37AM (#664854)

  NT had a pretty good security model, in theory. The ACL model is a lot more flexible than the unix owner-group-other model. Unfortunately, this also makes it a lot harder to understand, with the result that any permission problem is solved by running everything as Administrator.

  On top of that, NT was a lot closer to being a micro-kernel than any unix outside of Minix, but then they decided that graphics performance was more important than security and stability, and moved the graphics drivers into ring0. And we probably all know that graphics drivers are notoriously hard to get correct.

  Parent

  Starting Score:	0		points
  Moderation		+1
  Insightful=1, Total=1
  Extra 'Insightful' Modifier		0
  Total Score:		1

• ''they decided that graphics performance...'' (Score: 0) by Anonymous Coward on Wednesday April 11 2018, @08:35AM

  by Anonymous Coward on Wednesday April 11 2018, @08:35AM (#665291)

  they decided that graphics performance was more important than security and stability

  "They" being the salesmen who run the company. (It's obviously NOT engineers in charge there).

  Yeah. Allowing user-supplied input into the realm where it can do maximum damage has to be the stupidest thing ever done by a software company.

  Of course, I think we all know that M$ isn't so much a software company as it is an abuse company that sells software as a way of delivering abuse.

  and moved the graphics drivers into ring0

  Let's not gloss over the specific case of font rendering.
  ...and, just in time, here's El Reg's headline:
  It's April 2018--and Patch Tuesday shows Windows security is still foiled by fiendish fonts [theregister.co.uk]

  -- OriginalOwner_ [soylentnews.org]

  Parent