Re: C# Exceptions

Correct, MiTM is the larger perspective where someone could sit in
between and tamper data to cause exceptions.

How easy/feasible would it be for an attaker to run malicious code on
the application by causing access violation?

Can he/she get SYSTEM level access or run commands as SYSTEM such as
adding an user by doing this malicious access violations?

Are the other exceptions like Null Reference or Invalid Operation
serious? Can they be converted to an Access Violation?

On 8/25/06, Krpata, Tyler <tkrpata@xxxxxxx> wrote:
It seems like you're saying that the application makes requests and
receives replies from a web service, and that you were able to crash the
application by sending invalid replies? In this case, maybe an attacker
that was able to launch a man in the middle attack could exploit the
application that way.

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------

Relevant Pages

  • Re: COM sometimes turns exceptions into HRESULTs, sometimes doesnt - why?
    ... try create object call object.method cause an access violation catch log error ... There's a project-wide setting to enable this behavior, called /EHa, if I recall correctly. ... structured exceptions are not C++ exceptions. ...
    (microsoft.public.win32.programmer.ole)
  • Re: Debugging VC6 DLL with a Delphi application
    ... If Delphi handles exceptions in DLLs, ... "Access violation" and "Stop always". ... Note that it can cause the debugger to stop often, ... It is also possible that Delphi has a setting that asks it to pass exceptions ...
    (microsoft.public.vc.debugger)