bugtraq - Pipe to FOR Crashes CMD

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 15 Jan 2008 10:41:06 -0500
From: "James C. Slora Jr." <james.slora@...a.com>
To: <bugtraq@...urityfocus.com>
Subject: Pipe to FOR Crashes CMD

Pipe the output of a command to FOR in (), and you crash the Windows
Vista Windows Command Processor (CMD.exe) with a DEP violation. I expect
it works on Server 2008 as well.

Maybe this is exploitable for privilege escalation, at least on a
machine with DEP disabled. I did not do any dump analysis or debugging
to find out.

Example:

Echo | for %i in () do rem

For ECHO you can substitute about any command. Any variation of FOR
seems to give the same results as long as "in ()".

Does not appear to work in XPSP2, Server 2003, or Win2000.

Reported to Microsoft yesterday. They declined to pursue an
authenticated self-DoS issue.