full-disclosure - Security Bug in MSVC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu Jan 19 20:15:07 2006
From: peak at argo.troja.mff.cuni.cz (Pavel Kankovsky)
Subject: Security Bug in MSVC

On Tue, 17 Jan 2006, Morning Wood wrote:

> extract, and open hello.dsw
> click "batch build, build" or "rebuild all"
> code will execute ( calc.exe and notepad.exe used as an example )

What's the point of building a bunch of sources unless
1. you trust their author, or
2. you have made sure their is nothing malicious there?

When you build an executable from untrusted sources, you get an untrusted
executable. Either you run it and you're screwed anyway, or you don't run
it and you wasted your time building it.

(Indeed, there are some marginal cases like when you want to build an 
executable file intended to run on someone else's computer...)

--Pavel Kankovsky aka Peak  [ Boycott Microsoft--http://www.vcnet.com/bms ]
"Resistance is futile. Open your source code and prepare for assimilation."