Advanced

Poor punctuation leads to Windows shell vulnerability

Posted by BernardSwiss on · 3 comments
Ars Technica; By Robert Lemos 		Mail this story
Print this story

A class of coding vulnerabilities could allow attackers to fool Windows system administrators into running malicious code because of a simple omission: quotation marks.

The attack relies on scripts or batch files that use the command-line interface, or "shell," on a Windows system but contain a simple coding error—allowing untrusted input to be run as a command. In the current incarnation of the exploit, an attacker appends a valid command onto the end of the name of a directory using the ampersand character. A script with the coding error then reads the input and executes the command with administrator rights.

Full Story

  Nav
» Read more about: Story Type: News Story, Security; Groups: Microsoft

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (3)

tuxchick ·
Windows leads to Windows vulnerabilities.
gus3 ·
"Microsoft Windows: Security as an Afterthought"
mbaehrlxer ·
i needed this a week ago, when i gave a talk on shellshock at barcamp. i had mostly a non-tech audience (as expected) including several windows users and it felt kinda funny to say that windows is not affected. (though some windows users didn't get it)

with this at least i could have said that while shellshock doesn't apply, there is this other very newly discovered shell problem...

greetings, eMBee.

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post