Text 5227, 76 rader
Skriven 2005-06-20 22:53:52 av Mike '/m' (1:379/45)
   Kommentar till text 5225 av Rich (1:379/45)
Ärende: Re: Microsoft meets the hackers
=======================================
From: Mike '/m' <mike@barkto.com>


I am not talking about what the reporter wrote, I am talking about what the
Microsoft security bulletin says in the Technical Details section.

===
The first vulnerability is a buffer overrun vulnerability. There is an
unchecked buffer in one of the components that handle NOTIFY directives
- messages that advertise the availability of UPnP-capable devices on
the network. By sending a specially malformed NOTIFY directive, it would be
possible for an attacker to cause code to run in the context of the UPnP
subsystem, which runs with System privileges on Windows XP. (On Windows 98 and
Windows ME, all code executes as part of the operating system). This would
enable the attacker to gain complete control over the system.
===

"There is an unchecked buffer".   Man, that sounds rather specific to
me.

 /m





On Mon, 20 Jun 2005 19:44:07 -0700, "Rich" <@> wrote:

>   That and of course that bulletins rarely if ever mention this level of
detail.  Unchecked buffers are one of the few exceptions and that I already
explained.  The reporter claimed he could overflow a buffer though did not, and
has not since that I can see, given any evidence of this.  My speculation is
that better err on the side of caution.
>
>Rich
>
>  "Rich" <@> wrote in message news:42b77b11$1@w3.nls.net...
>     Not odd.  I didn't analyze it until after I saw the public bulletin
release and what the reporter claims in his PR was the scenario that generated
overflows.  I don't believe the reporter understands what he saw or if he did
he kept that out of his PR and anything else I could find, public or private,
on the topic.  Unlike the reporter, I don't issue press releases or call
reporters with what I find even if it could be embarrassing to him.  But then I
don't have a financial interest in putting others at risk just to try to make
myself look good.
>
>  Rich
>
>    "Mike '/m'" <mike@barkto.com> wrote in message
news:15seb1pu019glla3ph9mnje9h2rogh4mnh@4ax.com...
>    Oddly, I see no mention of a race condition in the official Microsoft
>    security bulletin that was originally posted on December 20, 2001 and
>    updated on May 09, 2003
>    http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx
>
>     /m
>
>
>    On Mon, 20 Jun 2005 08:00:02 -0700, "Rich" <@> wrote:
>
>    >   A race condition.
>    >
>    >Rich
>    >
>    >  "Geo" <georger@nls.net> wrote in message news:42b699ed$2@w3.nls.net...
>    >  Well what was it then?
>    >
>    >  Geo.
>    >    "Rich" <@> wrote in message news:42b5feb2@w3.nls.net...
>    >       It is not a buffer overflow.  It is not a buffer overrun.
Neither.
>    >
>    >    Rich

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)