Re: [Full-disclosure] Re: It's not that simple...
From: Florian Weimer (fw_at_deneb.enyo.de)
Date: 08/18/05
- Previous message: howard.lee_at_guoco.com: "RE: [Full-disclosure] svchost.exe try to send http outside"
- In reply to: Jason Coombs: "Re: [Full-disclosure] Re: It's not that simple..."
- Next in thread: Paul Melson: "RE: [Full-disclosure] Re: It's not that simple..."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: jasonc@science.org Date: Thu, 18 Aug 2005 07:14:16 +0200
* Jason Coombs:
> Kurt Seifried wrote:
>> Actually it really is that simple. Disabling Null sessions is
>> entirely possible, quite easy, and doesn't break a lot (at least in
>> my previous
>
> Then why doesn't Microsoft provide these instructions in the workarounds
> section of the vulnerability announcement?
Attacks using proper accounts are still possible, AFAIK. These days,
it's hard to explain such fine points in advisories because all the
useful details have been eliminated and vendors fear to give away too
much information. In the present case, it didn't help to delay the
exploit, of course.
> I'm supposed to do Microsoft's job for them? No way.
Well, it's your computers that are potentially compromised, not
theirs.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
- Previous message: howard.lee_at_guoco.com: "RE: [Full-disclosure] svchost.exe try to send http outside"
- In reply to: Jason Coombs: "Re: [Full-disclosure] Re: It's not that simple..."
- Next in thread: Paul Melson: "RE: [Full-disclosure] Re: It's not that simple..."
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
