Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: [Full-disclosure] windows vulnerability? [was: Re: [Code-Crunchers] 137 bytes]
From: Thomas Pollet (thomas.polletgmail.com)
Date: Wed Nov 08 2006 - 07:38:06 CST
On 08/11/06, Gadi Evron <gelinuxbox.org> wrote:
> On Wed, 8 Nov 2006, onisan wrote:
> > One thing is in this makes it even more interesting, most of the
> > do not block this download, so it's smallest and most dangerous
> > at the same time :o
> What Alex did is very impressive! Matthew Murphy came up with the idea
> originally, I think, but it doesn't take from this amazing work in any
> *awe struck*
> I'd say more though, it's a vulnerability.
> If you can load a library remotely, and do so with no problems, it's a
> vulnerability in Windows. I am not sure of what kind quite yet.
Windows handles UNC paths the same way as local paths. Another mechanism
used to load a remote dll using a UNC path is described in
here the "system" directory is overwritten with a (unc) directory owned by
by the attacker. When GetSystemDirectoryW() is called to load the
faultrep.dll on exception, an attacker can supply his backdoored
faultrep.dll. I don't think you should classify this as a vulnerability,
it's known windows behaviour (yet, windows, a vulnerability all by itself?).
The mother of all downloaders.
> "The Zone has a new King!" <we're not worthy x3>
> -- Jeff, Coupling (BBC, UK).
> > -- G
> > 2006/11/8, Solar Eclipse < solareclipsephreedom.org>:
> > >
> > > On Tue, Nov 07, 2006 at 10:56:42AM -0800, Peter Ferrie wrote:
> > > > Why is the idata size present? AFAIK, no Windows version checks it.
> > > > Four bytes shorter, then (stop at the idata rva non-zero byte)?
> > >
> > > You're right, you can remove the last field and bring the file size
> > > to 133 bytes. That's what I get for claiming that the size can't be
> > > improved :-)
> > >
> > > Solar
> > > _______________________________________________
> > > Code-Crunchers mailing list
> > > Code-Cruncherswhitestar.linuxbox.org
> > > http://whitestar.linuxbox.org/mailman/listinfo/code-crunchers
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/