Re: [Full-Disclosure] RE: [Symantec Security Advisor] Symantec Security Check ActiveX Buffer Overflow

From: Jeremiah Cornelius (jeremiah_at_nur.net)
Date: 06/25/03

  • Next message: ATD: "[Full-Disclosure] A worm..." 
    To: "Cesar" <cesarc56@yahoo.com>, <full-disclosure@lists.netsys.com>
Date: Wed, 25 Jun 2003 12:46:37 -0700

    > If a control has a digital
    > signature, it means that the control has not been
    > tampered with and is guaranteed to be exactly the same
    > as when the software publisher created it.

    C'mon! This is assuming a secure PKI implementation, where you are assured
    that the Private Key has been maintained securely, and actually used by the
    party it was issued to. Microsoft's 'Authenticode' has emphatically
    failed to meet this description, ashas been demonstrated a number of times.
    The most dramatic with the distribution of compromised components, signed -
    apparently - by Microsoft (!!) with a legitimate but falsley issued key.
    All the more disastrous, as MS left out a certificate -revocation mechanism
    for 'Authenticode!'

    http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-017.asp 

    --
Jeremiah Cornelius
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: ATD: "[Full-Disclosure] A worm..."

    Relevant Pages

    • RE: add variable from outside table
      ... By saving this path for each doctor's signature, your code in your report ... First, I would not use an OLD control in the report, but use an Image control. ... Your sql statement would include the RACF, DoctorName, and the ImagePath ...
      (microsoft.public.access.formscoding)
    • RE: add variable from outside table
      ... The signature is the field with the image. ... First, I would not use an OLD control in the report, but use an Image control. ... Your sql statement would include the RACF, DoctorName, and the ImagePath ...
      (microsoft.public.access.formscoding)
    • ActiveX in doc
      ... I have written a "Signature" activex control for MS Word that allows users ... I think the message box may disappear if I set the macro security level to ...
      (microsoft.public.word.vba.general)