Microsoft Put Off Fixing Zero Day for 2 Years
So if I get this right, the attack vector here is<p>1) Take signed .MSI<p>2) Add my JAR of malware to the end of it<p>3) Send file to target<p>4) Target's computer recognizes the file as a signed MSI, ignoring the extra stuff at the end that's not part of the MSI<p>5) Target computer calls the JRE to launch the JAR<p>6) JRE ignores the MSI parts at the beginning of the file because compressed JAR files are loaded back-to-front<p>Obviously a major bug that signature validation ignores "extra" parts of the file, but a signature validation bug that (1) only affects specific types of files executed by a third-party runtime and (2) doesn't threaten system files (or any native executables at all) isn't an obviously critical vulnerability like an arbitrary "signature validation is totally broken" bug.