Stories
Slash Boxes
Comments

SoylentNews is people

Poor Punctuation Leads to Windows Shell Vulnerability

posted by martyb on Sunday October 12 2014, @10:45PM   Printer-friendly
from the you-can-quote-me-on-that dept.

An anonymous coward writes:

http://arstechnica.com/security/2014/10/poor-punctuation-leads-to-windows-shell-vulnerability/

"A class of coding vulnerabilities could allow attackers to fool Windows system administrators into running malicious code because of a simple omission: quotation marks."

The comments on the Ars Technica article are well worth reading for additional examples and descriptions. Better still, take a look at Command-injection vulnerability for COMMAND-Shell Scripts over at The Security Factory. The author provides a well-developed progression of possible attack vectors under Windows where environment variables and directory names can be used maliciously. In general, one should always surround references to %CD% (i.e. the current directory) with quotes: 

SET startdir="%CD%"

Another interesting case is illustrated by this code sample: 

SET B=T"&calc&
SET C="%B%"
where accessing the value of the environment variable B, even though it is quoted, causes the system to try and invoke a program called "calc" (i.e. the Windows calculator.)

 
This discussion has been archived. No new comments can be posted.
Poor Punctuation Leads to Windows Shell Vulnerability | Log In/Create an Account | Top | 18 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 0) by Anonymous Coward on Monday October 13 2014, @12:28PM

    by Anonymous Coward on Monday October 13 2014, @12:28PM (#105507)

    I just tried to install xdotool on my Debian VM. Somehow that package depends on systemd, and apt installed systemd without asking me first. Now my Debian VM fails while booting. I tried diagnosing it, but the log files were all gibberish. Maybe they're corrupt? Well I'm glad I make daily snapshots of my VM. I'm just going to revert back to yesterday's. Next weekend I'm going to move to FreeBSD. I can't risk systemd screwing up my VMs.

  • (Score: 1) by Refugee from beyond on Monday October 13 2014, @03:32PM

    by Refugee from beyond (2699) on Monday October 13 2014, @03:32PM (#105584)

    aptitude with -P always asks before it does something, though. Nor sure about "basic" apt/apt-get.

    --
    Instantly better soylentnews: replace background on article and comment titles with #973131.