2 ms·

In this case, there are 4 bugs. One causes N++ to write 1 to 3 bytes past the end of a buffer, the other bugs cause N++ to read some bytes past the end of heap

In this case, there are 4 bugs. One causes N++ to write 1 to 3 bytes past the end of a buffer, the other bugs cause N++ to read some bytes past the end of heap objects, even the researchers aren't sure how they could be exploited. While it's good they're fixed, it looks pretty much like what you get running code in a fuzzer with ASan enabled - finding obscure and very difficult to exploit memory correctness bugs. Unless a miracle happens and those 3 bytes can be made to belong to some very important structure, there's not much can be done with control of those 3 bytes.

boxed 3y ago
> 2023-08-15: Notepad++ v8.5.6 without the fixes was released. > 2023-08-21: Publishing according to our coordinated disclosure policy. I read it as NOT fixed.
- amiga386 3y ago
  Oh, that's more concerning. > 2023-07-17: Asked the maintainer if they successfully downloaded the binary PoC, if they have any questions and notified about the disclosure policy. No reply received. It doesn't sound like there's a dispute over these being bugs, but the author has forgotten or ignored this issue? But still.. * Headline: BUFFER OVERFLOWS! WRITES! (MAYBE) ARBITRARY CODE EXECUTION! * Details: we can make it continue 1 extra cycle of a loop to write beyond a string buffer boundary. We can't make it perform arbitrary code execution but you never know. If the string buffer abuts something important in memory (e.g. a return address on the stack), or you can manipulate things so that it does, then even 1 byte write is bad, so I wouldn't dismiss it out of hand... but it does seem like the researchers didn't find anything useful to do with their 3-byte overflow write. Hopefully the author picks this up and fixes it.
  - nyouhd 3y ago
    [dead]
BoardsOfCanada 3y ago
According to the article, just opening a malicious file may lead to arbitrary code execution, no? Edit: will -> may

boxed 3y ago

> 2023-08-15: Notepad++ v8.5.6 without the fixes was released. > 2023-08-21: Publishing according to our coordinated disclosure policy. I read it as NOT fixed.

amiga386 3y ago
Oh, that's more concerning. > 2023-07-17: Asked the maintainer if they successfully downloaded the binary PoC, if they have any questions and notified about the disclosure policy. No reply received. It doesn't sound like there's a dispute over these being bugs, but the author has forgotten or ignored this issue? But still.. * Headline: BUFFER OVERFLOWS! WRITES! (MAYBE) ARBITRARY CODE EXECUTION! * Details: we can make it continue 1 extra cycle of a loop to write beyond a string buffer boundary. We can't make it perform arbitrary code execution but you never know. If the string buffer abuts something important in memory (e.g. a return address on the stack), or you can manipulate things so that it does, then even 1 byte write is bad, so I wouldn't dismiss it out of hand... but it does seem like the researchers didn't find anything useful to do with their 3-byte overflow write. Hopefully the author picks this up and fixes it.
- nyouhd 3y ago
  [dead]

BoardsOfCanada 3y ago

According to the article, just opening a malicious file may lead to arbitrary code execution, no? Edit: will -> may