Re: White paper: Exploiting the Win32 API.

From: Adam Megacz (adam@xwt.org)
Date: 08/07/02 

To: bugtraq@securityfocus.com
From: Adam Megacz <adam@xwt.org>
Date: 07 Aug 2002 11:10:09 -0700

Roland Kaufmann <roland@ii.uib.no> writes:
> > 3) Microsoft cannot fix these vulnerabilities.

> (b) WM_TIMER messages are posted to the message queue and can be
> filtered by the application, as stated in the documentation for
> this message. The application can have a list over timers and check
> this for validity. (Moral of the story: Don't trust window message
> parameters any more than user input).

I believe this was his point -- Microsoft cannot fix this; we have to
rewrite every single Win32 application and arrange for it to maintain
this list.

This vulnerability strikes me as very similar to gets() -- the OS (or
C library) has provided a primitive which makes it seductively easy to
write insecure code.

  - a 

-- 
Sick of HTML user interfaces?
www.xwt.org

Amendment XXVIII: "thou shalt maximize thy stock price at all costs"

Relevant Pages

  • Re: Towards a responsible vulnerability process
    ... To believe that vendors all behave the ... Microsoft has run the train off the tracks many times in the past. ... Getting a fix is ... security vulnerabilities, vulnerabilities that can be widely exploited, and ...
    (NT-Bugtraq)
  • SecurityFocus Microsoft Newsletter #305
    ... Microsoft Office security, part one ... Microsoft Internet Explorer Multiple COM Object Color Property Denial of Service Vulnerabilities ... An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. ...
    (Focus-Microsoft)
  • Re: [Full-disclosure] Office 0day
    ... more and continue consulting for microsoft rather than criminal networks. ... to fix the product if it is flawed. ... That is like me trying to argue that after going to a car mechanic, ... "Members of the jury, by keeping quiet about the bug and not shipping a patch, ...
    (Full-Disclosure)
  • SecurityFocus Microsoft Newsletter #306
    ... Microsoft Office security, part two ... Microsoft Internet Explorer COM Object Instantiation Daxctle.OCX Heap Buffer Overflow vulnerability. ... Cybozu Garoon Multiple SQL Injection Vulnerabilities ...
    (Focus-Microsoft)
  • Re: [Full-disclosure] Microsofts Real Test with Vista is Vulnerabilities
    ... So if they can earn more from the subscription based security solution where is the incentive to make the OS more secure? ... I am far from a Microsoft marketing expert... ... Microsoft's Real Test with Vista is Vulnerabilities ...
    (Full-Disclosure)
Loading