Re: URI handling woes in Acrobat Reader, Netscape,Miranda, Skype



Dear All,

....Hi everyone. This is Jonathan from the SWI team in the MSRC. We?ve just released
Security Advisory 943521 regarding a vulnerability affecting Windows Server 2003 and
Windows XP with Internet Explorer 7 installed. As you have probably noted there?s
been a fair amount of discussion on this issue. One of the reasons we are releasing
this Advisory is due to increased risk given recent discussions about how this
vulnerability could be used in attacks. Another reason is to clear up the
confusion we see between the URI issue covered in today?s Advisory and the
protocol handler issue we documented in July in this IE Blog. The final reason
is we actually contributed to some of the confusion by providing an incorrect
set of talking points to Heise. Because these issues look very similar we?re
going to have some deep discussion on how Windows handles URIs.

To help explain the difference in detail, my co-workers Dave and Chen have helped
me put together some information...

http://blogs.technet.com/msrc/archive/2007/10/10/msrc-blog-additional-details-and-background-on-security-advisory-943521.aspx



--
http://secdev.zoller.lu
Thierry Zoller
Fingerprint : 5D84 BFDC CD36 A951 2C45 2E57 28B3 75DD 0AC6 F1C7



Relevant Pages

  • Re: [Full-disclosure] URI handling woes in Acrobat Reader, Netscape, Miranda, Skype
    ... Windows XP with Internet Explorer 7 installed. ... One of the reasons we are releasing ... this Advisory is due to increased risk given recent discussions about how this ...
    (Full-Disclosure)
  • [Full-disclosure] stratsec Security Advisory: SS-2010-007 Microsoft SMB Server Zero Size
    ... stratsec Security Advisory: SS-2010-007 MS SMB Server Zero Size Pool Allocation ... Issue type: Pool Corruption ... A vulnerability in the Windows kernel can be triggered via SMB in Microsoft ...
    (Full-Disclosure)
  • Make that VS 2005 Woes
    ... Working with a multiple project solution (Windows Forms, Web, Web Service ... to switch off the "Enable the Visual Studio Hosting Process" in My Project. ... Since Beta 2 I haven't been able to search for help (Visual Studio Common ... releasing VS 2005 in this state is a very grave mistake. ...
    (microsoft.public.vsnet.general)
  • V2 2005 Woes
    ... Working with a multiple project solution (Windows Forms, Web, Web Service ... to switch off the "Enable the Visual Studio Hosting Process" in My Project. ... Since Beta 2 I haven't been able to search for help (Visual Studio Common ... releasing VS 2005 in this state is a very grave mistake. ...
    (microsoft.public.vsnet.general)
  • [Full-Disclosure] [SCN #03] Windows* Shortcut (.lnk) File Denial of Service Resurfaced
    ... The following advisory is available in HTML at ... Windows* Shortcut File Denial of Service Resurfaced ... parsing certain malformed shortcut files, ... execute the .lnk file. ...
    (Full-Disclosure)