Re: [ros-dev] [ros-diffs] [cfinck] 33571: Check if the GetWindowsDirectory call succeeded and use PathAppend to prevent a buffer overflow, when WinDir + "\regedit.exe" > MAX_PATH

[Alex Ionescu]

If GetWindowsDirectory fails, you have much worse issues to worry
about than executable redirection.

Also note that regedt32.exe is usually in the system32 directory, so
how is this a security/redirection issue exactly?

This implies someone would have to:

1) Give you a malware regedit.exe in directory foo
2) Give you the legitimate regedt32.exe in directory foo
3) Somehow convince you to:
3.1) Use regedt32 instead of regedit (few people even know this tool)
3.2) Launch regedt32 from this "foo" directory instead of using
start/run regedt32

The issue you're looking for just doesn't exist.

2008/5/19 FENG Yu Ning <fengyuning1984(a)gmail.com>om>:
>   On Sun, May 18, 2008 at 7:28 PM, Alex Ionescu
> <ionucu(a)videotron.ca> wrote:
> >  
> >  Last nitpick: if you can't get the windows directory, just
> >  ShellExecute "regedit.exe" directly, as the code originally did --
> >  this is the behavior on Windows, fyi.
> >  
>  Though it is the behavior on Windows, it is a bad thing, IMHO. There are
>  already too many little viruses who pretend to be a system executable, say,
>  explorer.exe, and they are placed in a (sub)directory of the windows
>  directory to be shell executed. If we can't get the windows direcoty, we
>  should let the user know, and give them the chance to fix it, instead of
>  blindly execute anything.
>  I used to suffer from those, and they were really annoying. Please consider
>  being different from Windows in this and similar issues.
>  MHO.
>
>  _______________________________________________
>  Ros-dev mailing list
>  Ros-dev(a)reactos.org
>  http://www.reactos.org/mailman/listinfo/ros-dev
>
>  


--
Best regards,
Alex Ionescu



-- 
Best regards,
Alex Ionescu

[Filip Navara]

I will leave the issue of whether GetWindowsDirectory should be used
or not aside (even though I believe it's good to use it), but in all
honesty I couldn't ignore Alex's comment. The suggestion of fallback
feels to me like if you had an internet banking account and you said
"oh, well, if HTTPS doesn't work, let's just use HTTP, the system is
probably already f*cked up enough that security doesn't matter
anymore". This is exactly the type of attitude that introduces
security holes into programs... Why would I go a long way to write a
complicated code to avoid executable redirection if there's code
elsewhere that doesn't follow the rules? Remember, the chain is only
as strong as it's weakest link.

F.

On Mon, May 19, 2008 at 10:11 AM, Alex Ionescu <ionucu(a)videotron.ca> wrote:
>   If GetWindowsDirectory fails, you have much worse
> issues to worry
>  about than executable redirection.
>
>  Also note that regedt32.exe is usually in the system32 directory, so
>  how is this a security/redirection issue exactly?
>
>  This implies someone would have to:
>
>  1) Give you a malware regedit.exe in directory foo
>  2) Give you the legitimate regedt32.exe in directory foo
>  3) Somehow convince you to:
>  3.1) Use regedt32 instead of regedit (few people even know this tool)
>  3.2) Launch regedt32 from this "foo" directory instead of using
>  start/run regedt32
>
>  The issue you're looking for just doesn't exist.
>
>  2008/5/19 FENG Yu Ning <fengyuning1984(a)gmail.com>om>:
> >   On Sun, May 18, 2008 at 7:28 PM, Alex Ionescu
> > <ionucu(a)videotron.ca> wrote:
> > >  
> > >  Last nitpick: if you can't get the windows directory, just
> > >  ShellExecute "regedit.exe" directly, as the code originally did --
> > >  this is the behavior on Windows, fyi.
> > >  
> >  Though it is the behavior on Windows, it is a bad thing, IMHO. There are
> >  already too many little viruses who pretend to be a system executable, say,
> >  explorer.exe, and they are placed in a (sub)directory of the windows
> >  directory to be shell executed. If we can't get the windows direcoty, we
> >  should let the user know, and give them the chance to fix it, instead of
> >  blindly execute anything.
> >  I used to suffer from those, and they were really annoying. Please consider
> >  being different from Windows in this and similar issues.
> >  MHO.
> >
> >  _______________________________________________
> >  Ros-dev mailing list
> >  Ros-dev(a)reactos.org
> >  http://www.reactos.org/mailman/listinfo/ros-dev
> >
> >  
>
>
>  --
>  Best regards,
>  Alex Ionescu
>
>
>
>  --
>  Best regards,
>  Alex Ionescu
>  _______________________________________________
>  Ros-dev mailing list
>  Ros-dev(a)reactos.org
>  http://www.reactos.org/mailman/listinfo/ros-dev
>

[Alex Ionescu]

Did you somehow forget to read the REST of my e-mail after my initial
"if that function failed, you're screwed anyway"?

Please come up with a valid exploitation technique for this fallback.

Please make sure it's doable from a non-admin account.

On Tue, May 20, 2008 at 5:08 PM, Filip Navara <xnavara(a)volny.cz> wrote:
>   I will leave the issue of whether GetWindowsDirectory
> should be used
>  or not aside (even though I believe it's good to use it), but in all
>  honesty I couldn't ignore Alex's comment. The suggestion of fallback
>  feels to me like if you had an internet banking account and you said
>  "oh, well, if HTTPS doesn't work, let's just use HTTP, the system is
>  probably already f*cked up enough that security doesn't matter
>  anymore". This is exactly the type of attitude that introduces
>  security holes into programs... Why would I go a long way to write a
>  complicated code to avoid executable redirection if there's code
>  elsewhere that doesn't follow the rules? Remember, the chain is only
>  as strong as it's weakest link.
>
>  F.
>
>  On Mon, May 19, 2008 at 10:11 AM, Alex Ionescu <ionucu(a)videotron.ca> wrote:
> >   If GetWindowsDirectory fails, you have much worse
> > issues to worry
> >  about than executable redirection.
> >
> >  Also note that regedt32.exe is usually in the system32 directory, so
> >  how is this a security/redirection issue exactly?
> >
> >  This implies someone would have to:
> >
> >  1) Give you a malware regedit.exe in directory foo
> >  2) Give you the legitimate regedt32.exe in directory foo
> >  3) Somehow convince you to:
> >  3.1) Use regedt32 instead of regedit (few people even know this tool)
> >  3.2) Launch regedt32 from this "foo" directory instead of using
> >  start/run regedt32
> >
> >  The issue you're looking for just doesn't exist.
> >
> >  2008/5/19 FENG Yu Ning <fengyuning1984(a)gmail.com>om>:
> > >   On Sun, May 18, 2008 at 7:28 PM, Alex Ionescu
> > > <ionucu(a)videotron.ca> wrote:
> > > >  
> > > >  Last nitpick: if you can't get the windows directory, just
> > > >  ShellExecute "regedit.exe" directly, as the code originally did --
> > > >  this is the behavior on Windows, fyi.
> > > >  
> > >  Though it is the behavior on Windows, it is a bad thing, IMHO. There are
> > >  already too many little viruses who pretend to be a system executable, say,
> > >  explorer.exe, and they are placed in a (sub)directory of the windows
> > >  directory to be shell executed. If we can't get the windows direcoty, we
> > >  should let the user know, and give them the chance to fix it, instead of
> > >  blindly execute anything.
> > >  I used to suffer from those, and they were really annoying. Please consider
> > >  being different from Windows in this and similar issues.
> > >  MHO.
> > >
> > >  _______________________________________________
> > >  Ros-dev mailing list
> > >  Ros-dev(a)reactos.org
> > >  http://www.reactos.org/mailman/listinfo/ros-dev
> > >
> > >  
> >
> >
> >  --
> >  Best regards,
> >  Alex Ionescu
> >
> >
> >
> >  --
> >  Best regards,
> >  Alex Ionescu
> >  _______________________________________________
> >  Ros-dev mailing list
> >  Ros-dev(a)reactos.org
> >  http://www.reactos.org/mailman/listinfo/ros-dev
> >  
>  _______________________________________________
>  Ros-dev mailing list
>  Ros-dev(a)reactos.org
>  http://www.reactos.org/mailman/listinfo/ros-dev
>  


-- 
Best regards,
Alex Ionescu