RE: WMF and the Windows Vulnerability Drought :>

["Dave Korn" <dave.korn () artimi com>]

Michael A Stevens wrote:
> > From
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/gdi/wingdista
rt_9ezp.asp
> "Security Considerations: GDI

>    ....   Bitmaps, metafiles, and fonts are complex structures that
> could become corrupted. It is good practice to try to ensure that these
> items are uncorrupted and from a trustworthy source.

> Perhaps whoever wrote that should have hit the IE developers with their
> clue-stick.


  Even more so whoever it was decided to move GDI into kernel-mode.  I'd bet
my $VALUABLE_ANATOMY_PART that there are masses of ring0 exploits yet to be
found in NtGdiXxxx/NtUserXxxx functions.  Privilege escalation, anyone? ;)




    cheers,
      DaveK
-- 
Can't think of a witty .sigline today....