Stories
Slash Boxes
Comments

SoylentNews is people

Poor Punctuation Leads to Windows Shell Vulnerability

posted by martyb on Sunday October 12 2014, @10:45PM   Printer-friendly
from the you-can-quote-me-on-that dept.

An anonymous coward writes:

http://arstechnica.com/security/2014/10/poor-punctuation-leads-to-windows-shell-vulnerability/

"A class of coding vulnerabilities could allow attackers to fool Windows system administrators into running malicious code because of a simple omission: quotation marks."

The comments on the Ars Technica article are well worth reading for additional examples and descriptions. Better still, take a look at Command-injection vulnerability for COMMAND-Shell Scripts over at The Security Factory. The author provides a well-developed progression of possible attack vectors under Windows where environment variables and directory names can be used maliciously. In general, one should always surround references to %CD% (i.e. the current directory) with quotes: 

SET startdir="%CD%"

Another interesting case is illustrated by this code sample: 

SET B=T"&calc&
SET C="%B%"
where accessing the value of the environment variable B, even though it is quoted, causes the system to try and invoke a program called "calc" (i.e. the Windows calculator.)

 
This discussion has been archived. No new comments can be posted.
Poor Punctuation Leads to Windows Shell Vulnerability | Log In/Create an Account | Top | 18 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 2) by frojack on Monday October 13 2014, @01:24AM

    by frojack (1554) on Monday October 13 2014, @01:24AM (#105380) Journal

    How long would it take me to write that in Python? I'd need to look up X.org bindings and libraries in Python, library hunting, documentation hunting, and probably end up spending a good hour or so.

    So you take some obscure thing you happen to know, and compare it to something you don't?
    Question: How long did it take you find xdottool the first time you needed it?

    --
    No, you are mistaken. I've always had this sig.
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  
    Total Score:   2  

  • (Score: 0) by Anonymous Coward on Monday October 13 2014, @01:46AM

    by Anonymous Coward on Monday October 13 2014, @01:46AM (#105388)

    -1 pedantic

    • (Score: 0) by Anonymous Coward on Monday October 13 2014, @10:02AM

      by Anonymous Coward on Monday October 13 2014, @10:02AM (#105474)

      -1 missing the point.

      Looking up xdotool is certainly not less effort than looking up Python X bindings.

      • (Score: 0) by Anonymous Coward on Monday October 13 2014, @12:28PM

        by Anonymous Coward on Monday October 13 2014, @12:28PM (#105507)

        I just tried to install xdotool on my Debian VM. Somehow that package depends on systemd, and apt installed systemd without asking me first. Now my Debian VM fails while booting. I tried diagnosing it, but the log files were all gibberish. Maybe they're corrupt? Well I'm glad I make daily snapshots of my VM. I'm just going to revert back to yesterday's. Next weekend I'm going to move to FreeBSD. I can't risk systemd screwing up my VMs.

        • (Score: 1) by Refugee from beyond on Monday October 13 2014, @03:32PM

          by Refugee from beyond (2699) on Monday October 13 2014, @03:32PM (#105584)

          aptitude with -P always asks before it does something, though. Nor sure about "basic" apt/apt-get.

          --
          Instantly better soylentnews: replace background on article and comment titles with #973131.