Presumably this is like many other graphics tool vulnerabilities this works by the attacker persuading a user to open a file that exercises the bug. Not terribly unusual.
replyI don't think so:
reply> User Interaction: None
> Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network.
> An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network.
replyWhat server is MS Paint running or what services does it provide?
Edit: Apparently you can use it to print an image from the command-line. Is that how this is being exploited?
MS Paint has Copilot now
replyDoes that turn it into a server or service?
replyI'm no expert but so much of Windows is implemented as services. svchost.exe is probably involved somehow. Like it wouldn't surprise me if Copilot is implemented as a service and it talks to Paint via IPC messages or something
replyBut that alone wouldn't make the service listen on the network, even if it were the case.
replyIt would make sense that it could listen for messages like "your generated image is ready!" and pass bitmap data to Paint. And media like images are a common source of vulnerabilities since you're basically passing binary data into the software.
replyIIS (Internet Impasto Server)
replyThis site doesn't do jokes
replyAt least not about serious security matters
replyThis site absolutely does jokes, it just doesn't beat horses into bloody pulps with the jokes the way reddit does. We have a higher standard. A joke has to actually be funny, and not some tired reference.
replyExcept for the infamous Dropbox comment.
Post a thread including the number "42" in the title, and you'll be proven wrong in the first 3 comments.
replyNot to imply any particular comparison to less serious websites where the karma system over time may have resulted in a disproportionate surplus of one liner jokes and other spammy low quality posts.
replyWhen they find a CVE RCE in minesweeper then you know it’s all over
replyDoes windows even have minesweeper anymore
replyYes, and it's 200+ MB: https://news.ycombinator.com/item?id=40647278
replyStill able to happily play rounds of Minesweeper on my 286-16!
replyNot out of the box.
replyTurns out we were sweeping for CVEs, not mines, all along
replyOf course the valuable link is down-weighted/buried in the HN discussion...
reply >Publicly disclosed
>No
>Exploited
>No
>Exploitability assessment
>Exploitation Less Likely