<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body>
<div dir="ltr">
<div></div>
<div>
<div>Hello Alan, I don’t think this is a Java vulnerability (but something Java application programmers have to deal with), that’s why I sent it to the mailing list (for lack of better channels).</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">Still there is a lesson to learn, we have two different windows file Name parsing behaviors in the openjdk.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">Microsoft (and the mass media) seems to be aware of the Windows problems.</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">Gruss</div>
<div dir="ltr">Bernd</div>
<div id="ms-outlook-mobile-signature">
<div style="direction: ltr">-- </div>
<div style="direction: ltr">http://bernd.eckenfels.net</div>
</div>
</div>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>Von:</b> Alan Bateman <Alan.Bateman@oracle.com><br>
<b>Gesendet:</b> Tuesday, January 19, 2021 9:26:02 AM<br>
<b>An:</b> Bernd <ecki@zusammenkunft.net>; OpenJDK Dev list <security-dev@openjdk.java.net>; nio-dev <nio-dev@openjdk.java.net><br>
<b>Betreff:</b> Re: Java and the NTFS Path weakness</font>
<div> </div>
</div>
<div><br>
<br>
<div class="x_moz-cite-prefix">On 18/01/2021 21:29, Bernd wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">Hello,
<div><br>
</div>
<div>bad news everyone. The second Windows Filesystem related security bug reported by <span style="">Jonas Lykkegaard which allows crashing Windows with a unpriveledged read access also affects JVM and it is not filtered by Path.of. Which means bot new File(bad).exists()
and Files.readAllLines(Path.of(bad)) will crash Windows immediatelly.</span></div>
<div><span style=""><br>
</span></div>
<div><span style="">I verified this on the latest Windows Server 2019 January Security Update.</span></div>
<div><span style=""><br>
</span></div>
<div><span style="">var bad = "\\</span><span style="">\\.\\globalroot\\device\\condrv\\kernelconnect</span><span style="">"</span></div>
<br>
</div>
</div>
</div>
</div>
</blockquote>
BSOD issues should be reported to Microsoft. If there is any suggestion of a JDK bug here then it should be reported to
<a class="x_moz-txt-link-abbreviated" href="mailto:vuln-report@openjdk.java.net">
vuln-report@openjdk.java.net</a>. We (at least Oracle engineers) cannot engage in any discussion of vulnerability issues here.<br>
<br>
-Alan<br>
</div>
</body>
</html>