The current version of iTunes for Windows (and of course older versions
too) associates the following vulnerable command lines with some of the
supported file types/extensions:
daap=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
itls=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
itms=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
itmss=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
itpc=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
itsradio=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
iTunes=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
iTunes.AssocProtocol.daap=C:\
iTunes.AssocProtocol.itls=C:\
iTunes.AssocProtocol.itms=C:\
iTunes.AssocProtocol.itmss=C:\
iTunes.AssocProtocol.itpc=C:\
iTunes.AssocProtocol.pcast=C:\
itunesradio=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
pcast=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
The command line registered under
[HKEY_LOCAL_MACHINE\SOFTWARE\
@="C:\Program Files\iTunes\iTunes.exe"
shows the same beginners error too: an unquoted pathname allows the
execution of the rogue programs "C:\Program.exe" or "C:\Program Files.exe"
instead of the intended executable.
From <http://msdn.microsoft.com/
or <http://msdn.microsoft.com/
| Note: If any element of the command string contains or might contain
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| spaces, it must be enclosed in quotation marks. Otherwise, if the
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| element contains a space, it will not parse correctly. For instance,
| "My Program.exe" starts the application properly. If you use
| My Program.exe without quotation marks, then the system attempts to
| launch My with Program.exe as its first command line argument. You
| should always use quotation marks with arguments such as "%1" that are
| expanded to strings by the Shell, because you cannot be certain that
| the string will not contain a space.
"Long" filenames containing spaces exist for about 20 years in Windows.
It's REALLY time that every developer and every QA engineer knows how
to handle them properly.
If you detect such silly bugs: report them and get them fixed.
If the vendor does not fix them: trash the trash!
JFTR: this bugs only exists since Microsoft "masks" it.
See <http://msdn.microsoft.com/
well-known idiosyncrasy:
| For example, consider the string "c:\program files\sub dir\program name".
| This string can be interpreted in a number of ways.
| The system tries to interpret the possibilities in the following order:
| c:\program.exe files\sub dir\program name
| c:\program files\sub.exe dir\program name
| c:\program files\sub dir\program.exe name
| c:\program files\sub dir\program name.exe
Without this kludge this beginners error would get caught upon
the very first use of any of these command lines.
Since every user account created during Windows setup has administrative
rights every user owning such an account can create the rogue program,
resulting in a privilege escalation.
JFTR: no, the "user account control" is not a security boundary!
regards
Stefan Kanthak
stefan.kanthak@nexgo.de
PS: for static detection of these silly beginners errors download and
run <http://home.arcor.de/
To catch all instances of this beginners error download
<http://home.arcor.de/
<http://home.arcor.de/
<http://home.arcor.de/
and run SENTINEL.CMD
too) associates the following vulnerable command lines with some of the
supported file types/extensions:
daap=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
itls=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
itms=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
itmss=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
itpc=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
itsradio=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
iTunes=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
iTunes.AssocProtocol.daap=C:\
iTunes.AssocProtocol.itls=C:\
iTunes.AssocProtocol.itms=C:\
iTunes.AssocProtocol.itmss=C:\
iTunes.AssocProtocol.itpc=C:\
iTunes.AssocProtocol.pcast=C:\
itunesradio=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
pcast=C:\Program Files (x86)\iTunes\iTunes.exe /url "%1"
The command line registered under
[HKEY_LOCAL_MACHINE\SOFTWARE\
@="C:\Program Files\iTunes\iTunes.exe"
shows the same beginners error too: an unquoted pathname allows the
execution of the rogue programs "C:\Program.exe" or "C:\Program Files.exe"
instead of the intended executable.
From <http://msdn.microsoft.com/
or <http://msdn.microsoft.com/
| Note: If any element of the command string contains or might contain
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| spaces, it must be enclosed in quotation marks. Otherwise, if the
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| element contains a space, it will not parse correctly. For instance,
| "My Program.exe" starts the application properly. If you use
| My Program.exe without quotation marks, then the system attempts to
| launch My with Program.exe as its first command line argument. You
| should always use quotation marks with arguments such as "%1" that are
| expanded to strings by the Shell, because you cannot be certain that
| the string will not contain a space.
"Long" filenames containing spaces exist for about 20 years in Windows.
It's REALLY time that every developer and every QA engineer knows how
to handle them properly.
If you detect such silly bugs: report them and get them fixed.
If the vendor does not fix them: trash the trash!
JFTR: this bugs only exists since Microsoft "masks" it.
See <http://msdn.microsoft.com/
well-known idiosyncrasy:
| For example, consider the string "c:\program files\sub dir\program name".
| This string can be interpreted in a number of ways.
| The system tries to interpret the possibilities in the following order:
| c:\program.exe files\sub dir\program name
| c:\program files\sub.exe dir\program name
| c:\program files\sub dir\program.exe name
| c:\program files\sub dir\program name.exe
Without this kludge this beginners error would get caught upon
the very first use of any of these command lines.
Since every user account created during Windows setup has administrative
rights every user owning such an account can create the rogue program,
resulting in a privilege escalation.
JFTR: no, the "user account control" is not a security boundary!
regards
Stefan Kanthak
stefan.kanthak@nexgo.de
PS: for static detection of these silly beginners errors download and
run <http://home.arcor.de/
To catch all instances of this beginners error download
<http://home.arcor.de/
<http://home.arcor.de/
<http://home.arcor.de/
and run SENTINEL.CMD