Re: Microsoft SQL Server password cracking
From: Deus, Attonbitus (Thor@HAMMEROFGOD.COM)Date: 07/10/02
- Previous message: Ben Hutchings: "Re: Microsoft SQL Server password cracking"
- Maybe in reply to: Barry Dorrans: "Microsoft SQL Server password cracking"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 10 Jul 2002 13:46:14 -0700 From: "Deus, Attonbitus" <Thor@HAMMEROFGOD.COM> To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
At 01:22 PM 7/10/2002, Ben Hutchings wrote:
>You have misunderstood what the paper says.
Indeed I did- grossly...
>The patch is for the server
>executable (or the in-memory image); SQL Server may have poor security but
>it doesn't rely on client-side authentication! So it would be a useful
>payload for a buffer overflow exploit, but it does not in itself represent
>a vulnerability.
Thank you for pointing that out- even after an email exchange between
myself and the author, I still did not get that... I thought that was the
reason for the paper- now seeing that it requires some other means of
patching on the server mitigates most, if not all, of my concerns in the
matter. I actually feel a bit foolish now in thinking what I though ;)
Here's to being obtuse: Cheers!
AD
-----BEGIN PGP SIGNATURE-----
Version: PGP 7.1
iQA/AwUBPSydFohsmyD15h5gEQKcEgCg0ARr+cVL2uWXavdqSZqE78FLQfkAn3KO
t3ZmLcPVgwZGum5Jkve7jG6G
=fxmE
-----END PGP SIGNATURE-----
- Previous message: Ben Hutchings: "Re: Microsoft SQL Server password cracking"
- Maybe in reply to: Barry Dorrans: "Microsoft SQL Server password cracking"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
