Microsoft Put Off Fixing Zero Day for 2 Years
So if I get this right, the attack vector here is1) Take signed .MSI2) Add my JAR of malware to the end of it3) Send file to target4) Target's computer recognizes the file as a signed MSI, ignoring the extra stuff at the end that's not part of the MSI5) Target computer calls the JRE to launch the JAR6) JRE ignores the MSI parts at the beginning of the file because compressed JAR files are loaded back-to-frontObviously a major bug that signature validation ignores "extra" parts of the file, but a signature validation bug that (1) only affects specific types of files executed by a third-party runtime and (2) doesn't threaten system files (or any native executables at all) isn't an obviously critical vulnerability like an arbitrary "signature validation is totally broken" bug.