full-disclosure - Insecure call to CreateProcess()/CreateProcessAsUser()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <80321d330605210848i167415a5mc2a0352e00e6efef@mail.gmail.com>
Date: Sun May 21 16:48:53 2006
From: atarasco at gmail.com (Andres Tarasco)
Subject: Insecure call to
	CreateProcess()/CreateProcessAsUser()

That's a well known issue and is documented at
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/createprocess.asp

Andres tarasco

2006/5/21, Charles Morris <cmorris@...odu.edu>:
>
> Microsoft Explorer (iexplore.exe) calls CreateProcess() with
> lpApplicationName = NULL. Instead, the lpCommandLine variable is used.
> Unfortunateally, if the lpCommandLine variable is not quoted properly, the
> function will attempt to load&execute multiple other applications in
> the following fashion:
>
> lpCommandLine = C:\Program Files\Google\Google Talk\googletalk.exe
> Will attempt to execute:
> C:\Program.exe
> C:\Program Files\Google\Google.exe
> C:\Program Files\Google\Google Talk\googletalk.exe
>
> If Microsoft Hyperterminal is set up to be your default telnet client,
> this behavior is known to be triggered from the web with a telnet:// style
> link.
>
>
> Microsoft was notified, they told me it was a "non issue", that they
> coulden't reproduce it, and basically "dont worry about it". or
> something. Unfortunateally although explorer.exe warns a user when the
> file "C:\Program.exe" exists, it does not check any other paths,
> therefore it is not nearly a sufficient workaround.
>
> --
> Charles Morris
>         cmorris@...odu.edu
>
> Network Administrator
> CS Systems Group                Old Dominion University
> http://15037760514/~cmorris
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>



-- 
Loco de aTar
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060521/549f286f/attachment.html