4 ms·

Original source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1514&q= https://bugs.chromium.org/p/project-zero/issues/detail?id=15...

• saagarjha 9y ago
  Could someone who’s more knowledgeable about how Windows works than I am provide a semi-technical explanation of how this works?
  • campuscodi 9y ago
    Yeah. It's not as severe as the article makes it seem. It's just a bypass in a very insignificant component for which you need 2-3 other vulns to exploit. I presume the editor just wanted to put an article out with Microsoft and Project Zero in the title, rather than analyze the actual flaw in the context of its severity.
    • nabc45 9y ago
      A journalist lying. Not particularly noteworthy.
      • ILikeConemowk 9y ago
        Didn't you get the memo? It's not lying, it's giving newsworthy events a "spin" and it totes OK and ethical, because everyone else does it and we're the good guys. /s
      • pmyteh 9y ago
        The press had many problems, but this isn't close to a lie. Sensationalistic? Maybe. But to accuse the journalist of lying is claiming that the article is (1) false, and (2) that the journalist knows it's false. They're big claims, not to be made as throwaway snark. A functioning (and honest) press matters, and this does it and ourselves no benefit.
  • pjc50 9y ago
    There is a lockdown mode which restricted which COM objects could be instantiated from .net code to a short whitelist. The whitelist is based on GUID. The lookup of GUID to actual binary is done through the registry. COM hosting implementations should check that the object they got is the one they asked for. Net doesn't. So if you can write to the registry you can escape the sandbox.