full-disclosure - [FD] Defense in depth -- the Microsoft way (part 78): completely outdated, vulnerable open source component(s) shipped with Windows 10&11

Open Source and information security mailing list archives

Message-ID: <14C8CF38CFFE4051810E04B58BBFC7B6@H270>
Date: Wed, 13 Oct 2021 01:18:46 +0200
From: "Stefan Kanthak" <stefan.kanthak@...go.de>
To: <fulldisclosure@...lists.org>
Cc: bugtraq@...urityfocus.com
Subject: [FD] Defense in depth -- the Microsoft way (part 78): completely
	outdated,
	vulnerable open source component(s) shipped with Windows 10&11

Hi @ll,

in December 2017, Microsoft announced to ship curl.exe and tar.exe
with Windows 10:
<https://docs.microsoft.com/en-us/virtualization/community/team-blog/2017/20171219-tar-and-curl-come-to-windows>

But they failed once again, MISERABLY, at least for curl: they took
the sources released 2017-11-14, let them rot for 2 years, applied
some patches, only to let them rot again since then!

| C:\Users\Public>winver
| Microsoft Windows [Version 10.0.19042.1083]
|
| C:\Users\Public>curl -V
| curl 7.55.1 (Windows) libcurl/7.55.1 WinSSL
| Release-Date: 2017-11-14, security patched: 2019-11-05
| Protocols: dict file ftp ftps http https imap imaps pop3 pop3s smtp smtps telnet tftp
| Features: AsynchDNS IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL

Version 7.55.1 is 34 releases and at least 15 (in words: FIFTEEN)
CVEs behind the current version 7.79.1: see 
<https://curl.se/docs/releases.html> and
<https://curl.se/docs/vulnerabilities.html>

Most obviously Microsoft's processes are so bad that they can't
build a current version and have to ship ROTTEN software instead!

stay tuned, and far away from such poorly maintained crap
Stefan Kanthak

Timeline
~~~~~~~~

2021-07-21 Vulnerability report sent to vendor

2021-07-22 Vendor acknowledged receipt, opened MSRC case 66388

2021-07-26 Vendor confirmed vulnerability

2021-08-05 Vendor announced fix, scheduled for release on 2021-10-12

2021-10-12 NO FIX RELEASED

Instead, the "security" update <https://support.microsoft.com/help/5006672>
ships the vulnerable component built 2019-08-12: see
<https://download.microsoft.com/download/1/2/8/12827989-db1c-4765-b6a7-ae7ecc7e2ba3/5006672.csv>

| curl.exe,7.55.1.0,12-Aug-2019,19:46,"386,048"
| curl.exe,7.55.1.0,12-Aug-2019,20:28,"421,376"
| curl.exe,7.55.1.0,12-Aug-2019,19:46,"386,048"
...
| Windows 10 version 1809 LCU Arm64-based,,,,
| File name,File version,Date,Time,File size
| curl.exe,7.55.1.0,12-Aug-2019,19:37,"330,240"
...
| curl.exe,7.55.1.0,12-Aug-2019,19:46,"386,048"
...
| curl.exe,7.55.1.0,12-Aug-2019,20:22,"435,712"

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives