Text 5296, 126 rader
Skriven 2005-06-22 17:56:12 av Mike '/m' (1:379/45)
   Kommentar till text 5253 av Rich (1:379/45)
Ärende: Re: Microsoft meets the hackers
=======================================
From: Mike '/m' <mike@barkto.com>


All I am asking is whether I can believe what that Microsoft security bulletin
says.

 /m


On Tue, 21 Jun 2005 15:20:32 -0700, "Rich" <@> wrote:

>   You aren't saying much of anything except your typical propaganda.  What do
you hope to gain by making claims regarding something about which you know
something to someone who actually does know something?  Is this how you try to
feel better about yourself?
>
>Rich
>
>  "Mike '/m'" <mike@barkto.com> wrote in message
news:081hb1hkkat3tf0s5fk5be6d09sbju0bf6@4ax.com...
>
>  Once again, I am not saying anything about what the reporter claimed.
>
>  The Microsoft security bulletin states, "There is an unchecked buffer".
>  http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx
>
>  Are you saying that the person who wrote that security bulletin
>  published incorrect information about the security problem, and left it
>  in place even after a revision of the bulletin?
>
>
>   /m
>
>
>
>  On Mon, 20 Jun 2005 21:05:07 -0700, "Rich" <@> wrote:
>
>  >   And this is what the reporter claimed.  Maybe you would not report what
was reported to you.  We likely will never know.  All we know today is that you
are willing to make all sorts of claims about something you know nothing about
trying to refute the statements of someone with very good knowledge of the
issue.  It's not like you will be any less clueless by repeating yourself over
and over.  Is this how you feel better about yourself?
>  >
>  >Rich
>  >
>  >  "Mike '/m'" <mike@barkto.com> wrote in message
news:buveb1lm4bkds04ndd83g288f8ti81v4dc@4ax.com...
>  >
>  >  I am not talking about what the reporter wrote, I am talking about what
>  >  the Microsoft security bulletin says in the Technical Details section.
>  >
>  >  ===
>  >  The first vulnerability is a buffer overrun vulnerability. There is an
>  >  unchecked buffer in one of the components that handle NOTIFY directives
>  >  - messages that advertise the availability of UPnP-capable devices on
>  >  the network. By sending a specially malformed NOTIFY directive, it would
>  >  be possible for an attacker to cause code to run in the context of the
>  >  UPnP subsystem, which runs with System privileges on Windows XP. (On
>  >  Windows 98 and Windows ME, all code executes as part of the operating
>  >  system). This would enable the attacker to gain complete control over
>  >  the system.
>  >  ===
>  >
>  >  "There is an unchecked buffer".   Man, that sounds rather specific to
>  >  me.
>  >
>  >   /m
>  >
>  >
>  >
>  >
>  >
>  >  On Mon, 20 Jun 2005 19:44:07 -0700, "Rich" <@> wrote:
>  >
>  >  >   That and of course that bulletins rarely if ever mention this level
of detail.  Unchecked buffers are one of the few exceptions and that I already
explained.  The reporter claimed he could overflow a buffer though did not, and
has not since that I can see, given any evidence of this.  My speculation is
that better err on the side of caution.
>  >  >
>  >  >Rich
>  >  >
>  >  >  "Rich" <@> wrote in message news:42b77b11$1@w3.nls.net...
>  >  >     Not odd.  I didn't analyze it until after I saw the public bulletin
release and what the reporter claims in his PR was the scenario that generated
overflows.  I don't believe the reporter understands what he saw or if he did
he kept that out of his PR and anything else I could find, public or private,
on the topic.  Unlike the reporter, I don't issue press releases or call
reporters with what I find even if it could be embarrassing to him.  But then I
don't have a financial interest in putting others at risk just to try to make
myself look good.
>  >  >
>  >  >  Rich
>  >  >
>  >  >    "Mike '/m'" <mike@barkto.com> wrote in message
news:15seb1pu019glla3ph9mnje9h2rogh4mnh@4ax.com...
>  >  >    Oddly, I see no mention of a race condition in the official
Microsoft
>  >  >    security bulletin that was originally posted on December 20, 2001
and
>  >  >    updated on May 09, 2003
>  >  >    http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx
>  >  >
>  >  >     /m
>  >  >
>  >  >
>  >  >    On Mon, 20 Jun 2005 08:00:02 -0700, "Rich" <@> wrote:
>  >  >
>  >  >    >   A race condition.
>  >  >    >
>  >  >    >Rich
>  >  >    >
>  >  >    >  "Geo" <georger@nls.net> wrote in message
news:42b699ed$2@w3.nls.net...
>  >  >    >  Well what was it then?
>  >  >    >
>  >  >    >  Geo.
>  >  >    >    "Rich" <@> wrote in message news:42b5feb2@w3.nls.net...
>  >  >    >       It is not a buffer overflow.  It is not a buffer overrun.
Neither.
>  >  >    >
>  >  >    >    Rich

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)