Serious Chrome zero-day

Re:Serious Chrome zero-day by tedunangst on Wednesday March 06, 2019 @07:43PM (#19324585)

> If you’re still on the fence about deploying this update, we would consider it Important since it could allow for attacker-controlled code to execute at the level of the logged on user.

What does that even mean? I download some c++ code from the internet, compile it, run it, and... it runs as my user?

[ Parent | on HN ]

Re:Serious Chrome zero-day by kllrnohj on Wednesday March 06, 2019 @08:18PM (#19324761)

https://portal.msrc.microsoft.com/en-US/security-guidance/ad...

> Exploitation of the vulnerability requires that a user open a specially crafted file which was compiled with an affected version of Visual Studio. In an email attack scenario, an attacker could exploit the vulnerability by sending a specially crafted project, or resource file, to the user and convince the user to open the file.

So yeah sure looks like a basic code execution results in code execution. Surprised this even got a CVE.

[ Parent | on HN ]

Re:Serious Chrome zero-day by pcwalton on Wednesday March 06, 2019 @08:55PM (#19324933)

Yeah, I think it means just that.

I guess there is some conceivable exploit where you compile some hostile code written in a safe language to C++ with MSVC and then run it, and the attacker could exploit this bug somehow? But who does that?

[ Parent | on HN ]