Microsoft Modifies Open-Source Code, Blows Hole In Windows Defender (theregister.co.uk)

An anonymous reader quotes a report from The Register: A remote-code execution vulnerability in Windows Defender -- a flaw that can be exploited by malicious .rar files to run malware on PCs -- has been traced back to an open-source archiving tool Microsoft adopted for its own use. The bug, CVE-2018-0986, was patched on Tuesday in the latest version of the Microsoft Malware Protection Engine (1.1.14700.5) in Windows Defender, Security Essentials, Exchange Server, Forefront Endpoint Protection, and Intune Endpoint Protection. This update should be installed, or may have been automatically installed already on your device. The vulnerability can be leveraged by an attacker to achieve remote code execution on a victim's machine simply by getting the mark to download -- via a webpage or email or similar -- a specially crafted .rar file while the anti-malware engine's scanning feature is on. In many cases, this analysis set to happen automatically.

When the malware engine scans the malicious archive, it triggers a memory corruption bug that leads to the execution of evil code smuggled within the file with powerful LocalSystem rights, granting total control over the computer. The screwup was discovered and reported to Microsoft by legendary security researcher Halvar Flake, now working for Google. Flake was able to trace the vulnerability back to an older version of unrar, an open-source archiving utility used to unpack .rar archives. Apparently, Microsoft forked that version of unrar and incorporated the component into its operating system's antivirus engine. That forked code was then modified so that all signed integer variables were converted to unsigned variables, causing knock-on problems with mathematical comparisons. This in turn left the software vulnerable to memory corruption errors, which can crash the antivirus package or allow malicious code to potentially execute.

Comments

Microsoft is a clueless newbie

[Required Snark]

Mass search and replace with no testing. A complete lack of understanding of simple principles of numeric comparisons. Not knowing the difference between unsigned and signed integers.

Sounds exactly like standard operating procedure at Microsoft.

Microsoft: bringing the Blue Screen of Death to Open Source Software since 2015.

"Open source" = geek-click-bait

[davidwr]

Nothing to see here.

Someone at MS modified code without understanding all the implications, and/or they modified code and someone else at MS called the code without being aware of the modification.

"Forking open source code" could just as easily been "bought closed-source project from third party them modified it," "hired contractor to write a library then modified it," or "forked code from another MS project then modified it."

Re:"Open source" = geek-click-bait

[Anonymous Coward]

Nothing to see here.

Someone at MS modified code without understanding all the implications, and/or they modified code and someone else at MS called the code without being aware of the modification.

Yep, nothing to see here. People at MS take code and modify it without understanding about integer overflows and signing conversion. It's not like that code goes into anything important used on billions of devices that could be exploited by mere exposure to a certain crafted filetype that mere possession should not be harmless. Certainly, MS hires people who know to take code from all sorts of sources and improve the good where those original authors don't have the discipline to write secure code.

In all seriousness, good thing Microsoft doesn't contribute to any open source projects. Right?

Re:"Open source" = geek-click-bait

[LoneTech]

Except the open source part meant: 1) They could make the modifications, 2) they could share those modifications, 3) the maintainer (or anyone competent) could have vetted and merged the changes, 4) there was no need to make the changes.

The breakage in this case happened because they made the change carelessly and chose not to participate in the usual quality control. And it caused a major security flaw in the program they force on users specifically for security. I'll grant you the situation would be no better with non-free software, and the carelessness in security critical contexts is a bigger issue, but open source had relevance.

Same old same old

[Ol Olsoc]

This is a Microsoft product. So it is no surprise. Benn a very insecure week for them. But they are getting better at simply inviting the bad guy in. Black Hats are thankin' ya Mister Nutella.

Re:GPL Violation?

[Anonymous Coward]

Unrar is not GPL licensed. Its freeware.

Re:NOT GPL.

[Anonymous Coward]

However if they didn't disclose in the Windows Defender documentation somewhere prominent that it is a violation of the license to use said code to reverse engineer the RAR file format, then they may have voided their license rights under the otherwise permissive license and Alexander Roshal may have standing to sue them.

No.

Here, let's remove all doubt about this license issue, shall we?

UnRAR - free utility for RAR archives
License for use and distribution of FREE portable version

The source code of UnRAR utility is freeware. This means:
      1. All copyrights to RAR and the utility UnRAR are exclusively
            owned by the author - Alexander Roshal.
      2. UnRAR source code may be used in any software to handle
            RAR archives without limitations free of charge, but cannot be
            used to develop RAR (WinRAR) compatible archiver and to
            re-create RAR compression algorithm, which is proprietary.
            Distribution of modified UnRAR source code in separate form
            or as a part of other software is permitted, provided that
            full text of this paragraph, starting from "UnRAR source code"
            words, is included in license, or in documentation if license
            is not available, and in source code comments of resulting package.
      3. The UnRAR utility may be freely distributed. It is allowed
            to distribute UnRAR inside of other software packages.
      4. THE RAR ARCHIVER AND THE UnRAR UTILITY ARE DISTRIBUTED "AS IS".
            NO WARRANTY OF ANY KIND IS EXPRESSED OR IMPLIED. YOU USE AT
            YOUR OWN RISK. THE AUTHOR WILL NOT BE LIABLE FOR DATA LOSS,
            DAMAGES, LOSS OF PROFITS OR ANY OTHER KIND OF LOSS WHILE USING
            OR MISUSING THIS SOFTWARE.
      5. Installing and using the UnRAR utility signifies acceptance of
            these terms and conditions of the license.
      6. If you don't agree with terms of the license you must remove
            UnRAR files from your storage devices and cease to use the
            utility.
            Thank you for your interest in RAR and UnRAR.
                                                                                        Alexander L. Roshal

Microsoft is not distributing their modified source code so they are not required to display this license in a separate license file, or program documentation, or comments in modified source code. They are not distributing source code because they don't have to. Clause 3 allows the utility to be distributed freely within other software without limitations. If Microsoft open sourced their anti-virus program and published its source code with the included unrar source code, then it would have to include the unrar license in some form as described above.