Announcement

Collapse
No announcement yet.

SHFileOperation and security

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • Michael Mattias
    replied
    As I read the link, no.

    You are not vulnerable because you don't check the status and THEN 'do it', you just "do it"; ergo you don't have any 'atomicity' (Sheesh, what a so-called word!) issues.

    Then again, you could simply copy, compare and delete instead of moving; except that WILL have issues if source file is in use. So if I were REALLY concerned I'd

    OPEN source file Exclusive
    OPEN desitination exclusive
    Get and PUT data
    CLOSE, CLOSE
    Delete source

    No way with this scenario anything can interfere, unless something can intrude into your process' memory whilst getting and putting. (Maybe memory map both files and move exclusively from your process' memory?)

    MCM

    Leave a comment:


  • Erich Schulman
    started a topic SHFileOperation and security

    SHFileOperation and security

    The issue is described at https://buildsecurityin.us-cert.gov/...1/826-BSI.html

    Would this code be vulnerable?

    Code:
    FUNCTION PBMAIN () AS LONG
    LOCAL shop AS SHFILEOPSTRUCT
    LOCAL shopQTHfrom,shopQTHto AS STRING
    LOCAL I AS LONG
        shopQTHfrom = "C:\temp\*.txt" + $NUL + $NUL
        shopQTHto   = "C:\temp2" + $NUL + $NUL
        shop.pFrom  = STRPTR(shopQTHfrom)
        shop.pTo    = STRPTR(shopQTHto)
        shop.hwnd   = 0
        shop.wFunc  = %FO_MOVE
        I = SHFILEOPERATION(shop)
        STDOUT "Result code = " + HEX$(I)
        WAITKEY$
    
    END FUNCTION
Working...
X