News for hackers. Stuff that matters.

A comment on Zero-click, wormable, cross-platform remote code execution in Microsoft Teams. Parent comment

Re:Zero-click, wormable, cross-platform remote code executio... by arthurcolle on Monday December 07, 2020 @04:45PM (#25338016)
> You can't set window.location.href=""; to a clickonce activation link because of a race condition in the download bar in IE.

I don't even... shakes head in dismay

[ Parent | on HN ]
Re:Zero-click, wormable, cross-platform remote code executio... by qz2 on Monday December 07, 2020 @05:00PM (#25338220)
It’s even worse when you realise I spent ten years convincing tens of large angry enterprises why they needed to deploy a registry fix to make our web based software work.

I put the cost of this bug for us just in the $100k range.

[ Parent | on HN ]
Re:Zero-click, wormable, cross-platform remote code executio... by arthurcolle on Monday December 07, 2020 @05:05PM (#25338283)
Were these deployed on prem on Windows servers?
[ Parent | on HN ]
Re:Zero-click, wormable, cross-platform remote code executio... by qz2 on Monday December 07, 2020 @05:10PM (#25338341)
No - web deployed click once applications. Straight to desktop from browser. Signed and whitelisted.
[ Parent | on HN ]