"An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.."
It mentions that it may rely on other services or security measures running- I wonder if there’s something like this hitting a firewall or av and then that calling out to paint to check file type or size out something like that?
The direct implication is that current generations of ms paint are a “service over the network.” Probably a theoretically possible RPC end point of svchost.exe
I'm thankfully out of the loop on Windows these days, but as I remember it Paint did not have any network features? Is that still true? If if is, maybe it is a misfiling of the CVE and it isn't remote?
Or are they chaining a browser auto opening a download in paint, (but browsers shouldn't do that)...
Or maybe after the .bmp file is executed, it can install something that opens an outbound TCP connection to its C2, and thus can receive commands. Would not need admin privileges because it doesn't open a port, just 'outbound' connections, like a long-poll.
Presumably this is like many other graphics tool vulnerabilities this works by the attacker persuading a user to open a file that exercises the bug. Not terribly unusual.
Fixed in version 11.2609.401.0.
Code execution, sure, paint has been used to write executable code too, so why not.
But remote? How
"An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.."
Still, the question remains... How?
It mentions that it may rely on other services or security measures running- I wonder if there’s something like this hitting a firewall or av and then that calling out to paint to check file type or size out something like that?
The direct implication is that current generations of ms paint are a “service over the network.” Probably a theoretically possible RPC end point of svchost.exe
I'm thankfully out of the loop on Windows these days, but as I remember it Paint did not have any network features? Is that still true? If if is, maybe it is a misfiling of the CVE and it isn't remote?
Or are they chaining a browser auto opening a download in paint, (but browsers shouldn't do that)...
These days paint has copilot...
This is the only network feature paint has iirc, so that's probably it.
Maybe because a .bmp file could be sent remotely.
Or maybe after the .bmp file is executed, it can install something that opens an outbound TCP connection to its C2, and thus can receive commands. Would not need admin privileges because it doesn't open a port, just 'outbound' connections, like a long-poll.
Wow! At first sight I was sure it was a joke, but no. What a time...
https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
Presumably this is like many other graphics tool vulnerabilities this works by the attacker persuading a user to open a file that exercises the bug. Not terribly unusual.
I don't think so:
> User Interaction: None
> Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.
> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network.
What server is MS Paint running?
When they find a CVE RCE in minesweeper then you know it’s all over