From: 3 shool (3shoolgmail.com)
Date: Fri Aug 25 2006 - 17:39:24 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Correct, MiTM is the larger perspective where someone could sit in
between and tamper data to cause exceptions.

How easy/feasible would it be for an attaker to run malicious code on
the application by causing access violation?

Can he/she get SYSTEM level access or run commands as SYSTEM such as
adding an user by doing this malicious access violations?

Are the other exceptions like Null Reference or Invalid Operation
serious? Can they be converted to an Access Violation?

On 8/25/06, Krpata, Tyler <tkrpatabjs.com> wrote:
> It seems like you're saying that the application makes requests and
> receives replies from a web service, and that you were able to crash the
> application by sending invalid replies? In this case, maybe an attacker
> that was able to launch a man in the middle attack could exploit the
> application that way.

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]