OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: [Full-disclosure] Windows .ANI LoadAniIcon Stack Overflow

From: Chris Lyon (cslyongmail.com)
Date: Sun Apr 01 2007 - 11:24:51 CDT

On 4/1/07, wac <waldoalvarez00gmail.com> wrote:
>
>
>
> On 4/1/07, Larry Seltzer <Larrylarryseltzer.com> wrote:
> >
> > >>The issue is that this only works with DEP turned off!
> >
> > Interesting point. I haven't seen this mentioned anywhere, including the
> > Microsoft advisory
> > ( http://www.microsoft.com/technet/security/advisory/935423.mspx).
> >
> > Has anyone actually tested this with DEP on/off to be sure?
>
>
Did you guys see this from the CISRT.

http://www.cisrt.org/enblog/read.php?68

Yes, winhex uses the function when you open the .ani and I don't have it
> running with DEP turned on and the same goes for firefox that also leaves
> the file openend when I openen web link dev sent me (already tested winhex
> with the address of exitprocess that btw seems to float around from system
> to system since the version dev sent me does not works for me and it works
> like a charm when I built it). I was talking with dev code about DEP
> bypassing btw, we think that is possible to exploit even with >> DEP ON <<.
> Just ideas for now.
>
> Larry Seltzer
> > eWEEK.com Security Center Editor
> > http://security.eweek.com/
> > http://blog.eweek.com/blogs/larry_seltzer/
> > Contributing Editor, PC Magazine
> > larryseltzerziffdavis.com
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/
> >
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/