Re: Privilege-escalation attacks on NT-based Windows are unfixable

From: Alun Jones (alun@texis.com)
Date: 08/22/02 

From: alun@texis.com (Alun Jones)
Date: Thu, 22 Aug 2002 00:42:44 GMT

In article <e155108f.0208211232.5329c4f@posting.google.com>,
a__l__a__n@hotmail.com (Alan) wrote:
>"Paul Rubin" <phr-n2002b@NOSPAMnightsong.com> wrote in message
> news:<7x7kikrmkp.fsf@ruckus.brouhaha.com>...
>> Is that not true of every OS? E.g., in Un*x, if there's a setuid root
>> program that spawns a shell, your box is 0wned.
>
>That is true. The difference is, in this case there is a well known
>vulnerability, with a well known public exploit, which the vendor
>intends NEVER TO FIX (in fact probably cannot fix).

Because the vendor believes that the correct place to fix it is in whatever
app believes it needs to have high security. Again, a secure app must not
trust any of its inputs that it cannot verify. The Windows message queue -
particularly a message queue associated with the interactive user's desktop -
is an unverifiable source of input, and thus must not be trusted by a secure
app.

Alun.
~~~~

[Please don't email posters, if a Usenet response is appropriate.] 

-- 
Texas Imperial Software   | Try WFTPD, the Windows FTP Server. Find us at
1602 Harvest Moon Place   | http://www.wftpd.com or email alun@texis.com
Cedar Park TX 78613-1419  | VISA/MC accepted.  NT-based sites, be sure to
Fax/Voice +1(512)258-9858 | read details of WFTPD Pro for XP/2000/NT.

Relevant Pages

  • Re: Privilege-escalation attacks on NT-based Windows are unfixable
    ... >intends NEVER TO FIX. ... app believes it needs to have high security. ... particularly a message queue associated with the interactive user's desktop - ... Fax/Voice +1258-9858 | read details of WFTPD Pro for XP/2000/NT. ...
    (comp.os.ms-windows.nt.admin.security)
  • Re: Is Linux A Feasible Platofrm For Professional DAW work ?
    ... that might fix it. ... then the problem is that DAW app, and there may or may not be a fix. ... this underscores the necessity to know what ... It's the analog emulation paradigm that I ...
    (rec.audio.pro)
  • Re: A cross-platform vision for Delphi
    ... Well yeah, but not every app I use has it's "Open" counterpart, I ... So I can fix the bugs myself. ... I'd pay royalty fees if they are reasonable and if the product ...
    (borland.public.delphi.non-technical)
  • Re: Control login or automatic service startup
    ... robust fix" because of time to market issues. ... know the root of the issue, the fix is unlikely going to be robust. ... with your own app launch. ... Basically you app should check/wait until the DSP service is up and running ...
    (microsoft.public.windowsxp.embedded)
  • Re: [SLE] a few Kmail oddities
    ... Hard to kill. ... app with that temp file as an argument. ... Although there was a fix added, it was later reverted - however ... Try creating a test user and see if it does the ...
    (SuSE)