Re: Vista SP1

["Robert Hensing (EL CONQUISTADOR)" <rhensing () microsoft com>]

I think you are wrong.  :)

As Alexander mentioned - IE on Vista SP1 does not opt-in to DEP by default still and I have verified that the Jscript 
heaps are still executable until you DO opt IE into DEP (and after doing so I have verified that standard heap spray 
techniques would fail).  Incidentally I've emailed Mark Dowd to see if he could test his exploit with IE opted-in to 
DEP for me and he hasn't gotten back with me yet so it's not clear if DEP will prevent the bytecode from executing or 
not.  I do know that Flash seems to work fine with DEP enabled in IE - so I'm assuming that Adobe is using 
VirtualProtect() to properly mark the pages that they need to be executable, as executable which would lead me to 
believe that Dowd's exploit would still work - even with DEP enabled (well - I'm assuming the AS bytecode would run - 
not sure about the x86 shellcode stage or where that could would be executing from - but if the x86 shellcode is also 
in pages marked executable by Adobe - then it's unlikely DEP wo
 uld be effective here).  Incidentally - ASLR *would* have been effective in stopping his exploit - but Adobe doesn't 
opt-in to that with Flash yet . . . but that doesn't mean YOU can't.  You can use link.exe to edit the flash9f.ocx and 
make it use ASLR. :)



-----Original Message-----
From: dailydave-bounces () lists immunitysec com [mailto:dailydave-bounces () lists immunitysec com] On Behalf Of Dave 
Aitel
Sent: Friday, April 25, 2008 8:41 AM
To: Alexander Sotirov; dailydave
Subject: Re: [Dailydave] Vista SP1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I've been told (although I did not write that exploit, Kostya did) that
you end up using opcodes in your bytecode stream to get execution. This
would mean that the bytecode stream has to be executable, which SP1
breaks. Not that this breaks the many other ways you can write the
exploit, but it would make it slightly harder.

I could be wrong on this
- -dave


Alexander Sotirov wrote:
| On Thu, Apr 24, 2008 at 07:27:18AM -0400, Dave Aitel wrote:
|> Vista SP1 was released to Automatic Update. One thing about SP1 is
that it
|> breaks the Flash exploit Mark Dowd describes in his paper by making
certain
|> memory NX.
|
| What memory does SP1 make NX? The iexplore.exe process is not on the
OptIn DEP
| list in Vista SP1, so everything in memory is always executable.
|
| Alex

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFIEdFztehAhL0gheoRAr/tAJ9MDoOPD4KLnmeaOglze/rvDCRq4QCfU+l/
R1DBA7fZM/p6bc4mXmAI77U=
=C+LF
-----END PGP SIGNATURE-----

_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave