3 ms·
> If you’re still on the fence about deploying this update, we would consider it Important since it could allow for attacker-controlled code to execute at the l
by tedunangst 8y ago
> If you’re still on the fence about deploying this update, we would consider it Important since it could allow for attacker-controlled code to execute at the level of the logged on user.
What does that even mean? I download some c++ code from the internet, compile it, run it, and... it runs as my user?
- kllrnohj 8y agohttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0546 https://portal.msrc.microsoft.com/en-US/security-guidance/ad... > Exploitation of the vulnerability requires that a user open a specially crafted file which was compiled with an affected version of Visual Studio. In an email attack scenario, an attacker could exploit the vulnerability by sending a specially crafted project, or resource file, to the user and convince the user to open the file. So yeah sure looks like a basic code execution results in code execution. Surprised this even got a CVE.
- pcwalton 8y agoYeah, I think it means just that. I guess there is some conceivable exploit where you compile some hostile code written in a safe language to C++ with MSVC and then run it, and the attacker could exploit this bug somehow? But who does that?