Graham Sutherland / Polynomialcan anyone recall any interesting vulnerabilities in Windows applications that were due to mishandling of character encoding and/or unexpected case sensitivity in file paths? ones with good write-ups strongly preferred.
looking specifically for Windows, specifically character encoding related bugs, and specifically bugs in apps rather than bugs in the OS's own file path handling (e.g. WorstFit)
#infosec
Graham Sutherland / PolynomialI am not looking for bugs relating to the handling of file contents.
I'm thinking more along the lines of assuming that file paths are always just ASCII strings, and then getting bitten by UTF-16 path names. or weird cases where two files with the same name but different case exist (e.g. due to FILE_FLAG_POSIX_SEMANTICS) leading to a security issue in an application.
I'm not looking for OS-level bugs like WorstFit.
Dave "Wear A Goddamn Mask" Cochran :donor:@gsuberland@chaos.social hold onto this and repost it next week imo
R.C.@gsuberland@chaos.social I'm reminded of https://en.m.wikipedia.org/wiki/Bush_hid_the_facts though I don't know if that's what you were looking for