Bugtraq mailing list archives
RE: First vulnerabilities in the SP2 - XP ?...
From: "Thor Larholm" <tlarholm () pivx com>
Date: Thu, 19 Aug 2004 10:17:07 -0700
From: Radoslav Dejanović [mailto:radoslav.dejanovic () opsus hr]On Monday 16 August 2004 15:58, Jrme ATHIAS wrote: http://www.heise.de/security/artikel/50051
This might be SP2 bug only if the same bug can't be repeated on pre-SP2 machine. Didn't test, but I think this is an old trick. Anyone care to test it?
The entire concept of the Zone.Identifier altenate data stream is new to XPSP2. Whenever you download any file from the web IE will add an ADS called Zone.Identifier which specifies what IE security zone the file originated from. Later, when the user tries to execute this file, Explorer itself will check for this ADS. If it does not exist Explorer will simply execute the file as it has always done, but if it does exist and it specifies the Internet zone Explorer will then check for a valid digital signature. If such a signature is not found Explorer will prompt the user and ask whether to execute this unknown executable from an unknown publisher. Regardless of whether we think this has a high practical impact the advisory from Jürgen does specify a way to circumvent a desired security functionality which has been addded to XPSP2. Circumventing a desired security functionality is always interested, especially seeing as this is one of many first steps in a move toward digitally signing all executables on the Windows platform. Regards Thor Larholm Senior Security Researcher PivX Solutions 23 Corporate Plaza #280 Newport Beach, CA 92660 http://www.pivx.com thor () pivx com Stock symbol: (PIVX.OB) Phone: +1 (949) 231-8496 PGP: 0x4207AEE9 B5AB D1A4 D4FD 5731 89D6 20CD 5BDB 3D99 4207 AEE9 PivX defines a new genre in Desktop Security: Proactive Threat Mitigation. <http://www.pivx.com/qwikfix>
Current thread:
- First vulnerabilities in the SP2 - XP ?... Jérôme (Aug 16)
- Re: First vulnerabilities in the SP2 - XP ?... Colin Alston (Aug 17)
- Re: First vulnerabilities in the SP2 - XP ?... Oliver Schneider (Aug 17)
- RE: First vulnerabilities in the SP2 - XP ?... Larry Seltzer (Aug 19)
- Re: First vulnerabilities in the SP2 - XP ?... Radoslav Dejanović (Aug 18)
- Re: First vulnerabilities in the SP2 - XP ?... Robert Decker (Aug 19)
- <Possible follow-ups>
- RE: First vulnerabilities in the SP2 - XP ?... Thor Larholm (Aug 19)
- Re: First vulnerabilities in the SP2 - XP ?... Matthew Roberts (Aug 20)
- RE: First vulnerabilities in the SP2 - XP ?... Larry Seltzer (Aug 23)