3

Recently I asked a question on Stack Overflow in regards to a bug I found in the cmd.exe batch parsing engine. Long story short it can cause a stack overflow (due to infinite recursion) or a memory leak because of the bug 'restarting' the parsing without failing properly. As I pointed in the question and the comments (and the 1 answer) have said, it does involve a user running the malformed script (i.e. social engineering) so if that can be done then the user already has bigger security concerns.

After a little more research, however, I do have more security questions in regards to this, like could a heap spray type of 'attack' be used in conjunction with this which would bypass DEP and ASLR. To this end I don't think I'll get an answer I'm looking for (something other than 'it's not exploitable because the user would have to run it') on Stack Overflow; as well I agree with some of the comments that the question is no longer an 'appropriate' question for Stack Overflow.

I think the InfoSec StackExchange could help in pointing out some more research articles I could read with regards to this question but I'm unsure if I should migrate it (some how?) or if I should close the current question and possibly ask a more concise question linking to it on the InfoSec Q&A site?

Thanks for any help

2
  • First, we need to decide whether the question is on-topic for Stack Overflow. Clearly I think it is, I was the first person who voted to re-open it. I don't understand why people think it is not on-topic. I'm interested to hear some of the rationales. But that question's comments thread is not an appropriate place to have those discussions. It is already too long for my attention span.
    – Cody Gray Mod
    Commented May 31, 2014 at 5:57
  • That post is ~4000 words long. Where is the actual question? It feels more like a personal blog post to me.
    – nobody
    Commented May 31, 2014 at 19:25

0

You must log in to answer this question.

Browse other questions tagged .