Full Disclosure mailing list archives
RE: Unchecked buffer in mstask.dll
From: "Dmitry Yu. Bolkhovityanov" <D.Yu.Bolkhovityanov () inp nsk su>
Date: Fri, 16 Jul 2004 11:22:28 +0700
On Thu, 15 Jul 2004, Paul Szabo wrote:
Being curious, on Win2k, I copied cmd.exe (from winnt\system32) as xyz.pif; then (right-click) Properties, Program crashes explorer. Is this related to IconHandler, and is it exploitable?
Right -- in Win2K SP4 clicking on [Program] tab of Properties window causes "access violation" -- the memory at 0x00000000 could not be "read" by SHELL32.DLL. MSVC++, acting as a debugger, shows a mixture of KERNEL32, COMCTL32, USER32, SHELL32 and SHLWAPI in stack trace. Disassembly window shows that there was an attempt to read dword at [EAX] (EAX=0). So at first glance this doesn't seem to be trivially exploitable, but I'm not a win32 expert, and intuition suggests that there must be a way. _________________________________________ Dmitry Yu. Bolkhovityanov The Budker Institute of Nuclear Physics Novosibirsk, Russia _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Unchecked buffer in mstask.dll Thor Larholm (Jul 14)
- <Possible follow-ups>
- RE: Unchecked buffer in mstask.dll vesselen.mironov (Jul 14)
- RE: Unchecked buffer in mstask.dll Paul Szabo (Jul 14)
- Re: RE: Unchecked buffer in mstask.dll Jordan Cole (stilist) (Jul 14)
- Re: RE: Unchecked buffer in mstask.dll Nick FitzGerald (Jul 14)
- Re: RE: Unchecked buffer in mstask.dll Jordan Cole (stilist) (Jul 14)
- Re: RE: Unchecked buffer in mstask.dll Tim (Jul 14)
- Re: RE: Unchecked buffer in mstask.dll Curt Purdy (Jul 15)
- Re: RE: Unchecked buffer in mstask.dll Jordan Cole (stilist) (Jul 14)
- RE: Unchecked buffer in mstask.dll Dmitry Yu. Bolkhovityanov (Jul 16)
- RE: [ok] RE: Unchecked buffer in mstask.dll Curt Purdy (Jul 16)