3 ms·

It's a bad time for the C programming language. First OpenSSL. Then SQLite this week. Now HTTP.sys. They didn't move HTTP into the kernel as a driver lightly; i

by nbevans 12y ago

It's a bad time for the C programming language. First OpenSSL. Then SQLite this week. Now HTTP.sys. They didn't move HTTP into the kernel as a driver lightly; it was done on the assumption the code would be vetted and tested throughly. Clearly that has failed.

MichaelGG 12y ago
Not so fast. We don't know if this is actually a memory safety issue. It be some sort of non-memory logic error.
- UnoriginalGuy 12y ago
  A non-memory logic error that allows remote code execution by breaking the stack? Can you give an example? Most of the examples I can think of are either directly or indirectly a problem of memory safety (for execution remote code rather than simply crashing (like a stack overflow)).
  - MichaelGG 12y ago
    I don't see any details about breaking the stack (just the HTTP stack). Maybe you can request arbitrary ranges of files and they get cached in a way that lets you reference them as ISAPI filters. I'm grasping at straws but I'm not feeling particularly creative right now. I was also being slightly sarcastic. I'd take the bet this is a memory safety issue, but there's a chance it isn't.
  - 0x0 12y ago
    How about that old WMF vulnerability? :)
higherpurpose 12y ago
By OpenSSL are you referring to HeartBleed? Windows has already had a similarly serious (let's call it) "bug" that allowed remote execution in IIS servers. Except unlike Heartbleed which only existed for 2 years, Microsoft's bug was in Windows for 20 years. But since Microsoft (on purpose) didn't make a unique name and logo for it, the media didn't pick it up. They gave it an obscure name and made it part of a larger Windows update, where they also added a few other "security improvements", which the media actually reported on more than on the bug. Some were calling it "WinShock" if you want to Google (or Bing) for it.
- gtirloni 12y ago
  Interesting that if you don't make a show out of a bug, you're doing it "on purpose". I assume you didn't mean to generalize but the current practice of naming bugs, making logos and what not is just silly.
- nbevans 12y ago
  "But since Microsoft (on purpose) didn't make a unique name and logo for it, the media didn't pick it up." Haha! I don't think MS got that memo about having to name bugs and make logos.

by nbevans 12y ago

MichaelGG 12y ago

Not so fast. We don't know if this is actually a memory safety issue. It be some sort of non-memory logic error.

UnoriginalGuy 12y ago
A non-memory logic error that allows remote code execution by breaking the stack? Can you give an example? Most of the examples I can think of are either directly or indirectly a problem of memory safety (for execution remote code rather than simply crashing (like a stack overflow)).
- MichaelGG 12y ago
  I don't see any details about breaking the stack (just the HTTP stack). Maybe you can request arbitrary ranges of files and they get cached in a way that lets you reference them as ISAPI filters. I'm grasping at straws but I'm not feeling particularly creative right now. I was also being slightly sarcastic. I'd take the bet this is a memory safety issue, but there's a chance it isn't.
- 0x0 12y ago
  How about that old WMF vulnerability? :)

higherpurpose 12y ago

By OpenSSL are you referring to HeartBleed? Windows has already had a similarly serious (let's call it) "bug" that allowed remote execution in IIS servers. Except unlike Heartbleed which only existed for 2 years, Microsoft's bug was in Windows for 20 years. But since Microsoft (on purpose) didn't make a unique name and logo for it, the media didn't pick it up. They gave it an obscure name and made it part of a larger Windows update, where they also added a few other "security improvements", which the media actually reported on more than on the bug. Some were calling it "WinShock" if you want to Google (or Bing) for it.

gtirloni 12y ago
Interesting that if you don't make a show out of a bug, you're doing it "on purpose". I assume you didn't mean to generalize but the current practice of naming bugs, making logos and what not is just silly.
nbevans 12y ago
"But since Microsoft (on purpose) didn't make a unique name and logo for it, the media didn't pick it up." Haha! I don't think MS got that memo about having to name bugs and make logos.