Text 5335, 142 rader
Skriven 2005-06-23 17:46:08 av Mike '/m' (1:379/45)
   Kommentar till text 5302 av Rich (1:379/45)
Ärende: Re: Microsoft meets the hackers
=======================================
From: Mike '/m' <mike@barkto.com>


I think is it a matter of you being deliberately evasive.

 /m

On Wed, 22 Jun 2005 16:41:52 -0700, "Rich" <@> wrote:

>   You are pretty clear that you believe only what you want to believe.
>
>Rich
>
>  "Mike '/m'" <mike@barkto.com> wrote in message
news:egnjb19bg13ail2588m87un2r08b9j7ke5@4ax.com...
>
>  All I am asking is whether I can believe what that Microsoft security
>  bulletin says.
>
>   /m
>
>
>  On Tue, 21 Jun 2005 15:20:32 -0700, "Rich" <@> wrote:
>
>  >   You aren't saying much of anything except your typical propaganda.  What
do you hope to gain by making claims regarding something about which you know
something to someone who actually does know something?  Is this how you try to
feel better about yourself?
>  >
>  >Rich
>  >
>  >  "Mike '/m'" <mike@barkto.com> wrote in message
news:081hb1hkkat3tf0s5fk5be6d09sbju0bf6@4ax.com...
>  >
>  >  Once again, I am not saying anything about what the reporter claimed.
>  >
>  >  The Microsoft security bulletin states, "There is an unchecked buffer".
>  >  http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx
>  >
>  >  Are you saying that the person who wrote that security bulletin
>  >  published incorrect information about the security problem, and left it
>  >  in place even after a revision of the bulletin?
>  >
>  >
>  >   /m
>  >
>  >
>  >
>  >  On Mon, 20 Jun 2005 21:05:07 -0700, "Rich" <@> wrote:
>  >
>  >  >   And this is what the reporter claimed.  Maybe you would not report
what was reported to you.  We likely will never know.  All we know today is
that you are willing to make all sorts of claims about something you know
nothing about trying to refute the statements of someone with very good
knowledge of the issue.  It's not like you will be any less clueless by
repeating yourself over and over.  Is this how you feel better about yourself?
>  >  >
>  >  >Rich
>  >  >
>  >  >  "Mike '/m'" <mike@barkto.com> wrote in message
news:buveb1lm4bkds04ndd83g288f8ti81v4dc@4ax.com...
>  >  >
>  >  >  I am not talking about what the reporter wrote, I am talking about
what
>  >  >  the Microsoft security bulletin says in the Technical Details section.
>  >  >
>  >  >  ===
>  >  >  The first vulnerability is a buffer overrun vulnerability. There is an
>  >  >  unchecked buffer in one of the components that handle NOTIFY
directives
>  >  >  - messages that advertise the availability of UPnP-capable devices on
>  >  >  the network. By sending a specially malformed NOTIFY directive, it
would
>  >  >  be possible for an attacker to cause code to run in the context of the
>  >  >  UPnP subsystem, which runs with System privileges on Windows XP. (On
>  >  >  Windows 98 and Windows ME, all code executes as part of the operating
>  >  >  system). This would enable the attacker to gain complete control over
>  >  >  the system.
>  >  >  ===
>  >  >
>  >  >  "There is an unchecked buffer".   Man, that sounds rather specific to
>  >  >  me.
>  >  >
>  >  >   /m
>  >  >
>  >  >
>  >  >
>  >  >
>  >  >
>  >  >  On Mon, 20 Jun 2005 19:44:07 -0700, "Rich" <@> wrote:
>  >  >
>  >  >  >   That and of course that bulletins rarely if ever mention this
level of detail.  Unchecked buffers are one of the few exceptions and that I
already explained.  The reporter claimed he could overflow a buffer though did
not, and has not since that I can see, given any evidence of this.  My
speculation is that better err on the side of caution.
>  >  >  >
>  >  >  >Rich
>  >  >  >
>  >  >  >  "Rich" <@> wrote in message news:42b77b11$1@w3.nls.net...
>  >  >  >     Not odd.  I didn't analyze it until after I saw the public
bulletin release and what the reporter claims in his PR was the scenario that
generated overflows.  I don't believe the reporter understands what he saw or
if he did he kept that out of his PR and anything else I could find, public or
private, on the topic.  Unlike the reporter, I don't issue press releases or
call reporters with what I find even if it could be embarrassing to him.  But
then I don't have a financial interest in putting others at risk just to try to
make myself look good.
>  >  >  >
>  >  >  >  Rich
>  >  >  >
>  >  >  >    "Mike '/m'" <mike@barkto.com> wrote in message
news:15seb1pu019glla3ph9mnje9h2rogh4mnh@4ax.com...
>  >  >  >    Oddly, I see no mention of a race condition in the official
Microsoft
>  >  >  >    security bulletin that was originally posted on December 20, 2001
and
>  >  >  >    updated on May 09, 2003
>  >  >  >    http://www.microsoft.com/technet/security/bulletin/MS01-059.mspx
>  >  >  >
>  >  >  >     /m
>  >  >  >
>  >  >  >
>  >  >  >    On Mon, 20 Jun 2005 08:00:02 -0700, "Rich" <@> wrote:
>  >  >  >
>  >  >  >    >   A race condition.
>  >  >  >    >
>  >  >  >    >Rich
>  >  >  >    >
>  >  >  >    >  "Geo" <georger@nls.net> wrote in message
news:42b699ed$2@w3.nls.net...
>  >  >  >    >  Well what was it then?
>  >  >  >    >
>  >  >  >    >  Geo.
>  >  >  >    >    "Rich" <@> wrote in message news:42b5feb2@w3.nls.net...
>  >  >  >    >       It is not a buffer overflow.  It is not a buffer overrun.
Neither.
>  >  >  >    >
>  >  >  >    >    Rich

--- BBBS/NT v4.01 Flag-5
 * Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)