Full Disclosure mailing list archives
Re: Windows .ANI LoadAniIcon Stack Overflow
From: "Larry Seltzer" <Larry () larryseltzer com>
Date: Sun, 1 Apr 2007 17:45:04 -0400
I'm not familiar with Solar Eclipe's claims. I thought the low-entropy argument was impeached a while ago. See http://blogs.msdn.com/michael_howard/archive/2006/10/04/Alleged-Bugs-in- Windows-Vista_1920_s-ASLR-Implementation.aspx The author of the original paper arguing low entropy replies to the blog conceding the point. There are two stages of randomization. Perhaps your exploit proves this wrong, but it's the last I heard on the subject. And even if there are only 256 slots how do you try more than one? Isn't the first wrong one going to crash the browser? As for the exploits in protected mode I'm sure there are things you can do, but it's a huge step down from what you can do in XP and it's gone as soon as you exit IE7 Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blog.eweek.com/blogs/larry%5Fseltzer/ Contributing Editor, PC Magazine larryseltzer () ziffdavis com -----Original Message----- From: Dave Aitel [mailto:dave () immunityinc com] Sent: Sunday, April 01, 2007 3:42 PM To: Larry Seltzer Cc: dev code; full-disclosure () lists grok org uk Subject: Re: [Full-disclosure] Windows .ANI LoadAniIcon Stack Overflow -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ASRL has limited entropy and the attacker can continue to try exploits an infinite number of times (as Solar Eclipse points out). This means you can write a reliable Vista exploit, theoretically. I'll probably finish one up on Monday. IE in protected mode would still allow you access to the local network and, more importantly, anything IE does. You could, for example, inject code into all viewed webpages that steals passwords and whatnot. Just at the very minimum. - -dave Larry Seltzer wrote:
It is completely possible to execute shellcode if we can do some DEPbypass (ie. ret2libc attack, etc..) In Vista this should have problems because of ASLR, right? I'm beginning to think that web-based attacks with this in Vista aren't really so scary. Even if you can get them to execute what can you really do in IE protected mode? You need to get the user to run the ANI outside of IE. Can anyone say what actually happens if you read an e-mail in the Vista Mail program with an attack ANI embedded? Larry Seltzer eWEEK.com Security Center Editor http://security.eweek.com/ http://blog.eweek.com/blogs/larry%5Fseltzer/ Contributing Editor, PC Magazine larryseltzer () ziffdavis com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFGEAsYtehAhL0gheoRAutoAJ0QhPsOvcdCTU2dZZgkZYINC3+K3QCdFMQH UH02qnLi2Gbp07rLWpKv/5w= =4oC5 -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: Windows .ANI LoadAniIcon Stack Overflow Larry Seltzer (Apr 01)
- Re: Windows .ANI LoadAniIcon Stack Overflow dev code (Apr 01)
- Re: Windows .ANI LoadAniIcon Stack Overflow Larry Seltzer (Apr 01)
- Re: Windows .ANI LoadAniIcon Stack Overflow ad () heapoverflow com (Apr 01)
- Re: Windows .ANI LoadAniIcon Stack Overflow ad () heapoverflow com (Apr 01)
- Re: Windows .ANI LoadAniIcon Stack Overflow -> Its ok, its in IE Protected Mode Haroon Meer (Apr 01)
- Re: Windows .ANI LoadAniIcon Stack Overflow Dave Aitel (Apr 02)
- Re: Windows .ANI LoadAniIcon Stack Overflow Larry Seltzer (Apr 01)
- Re: Windows .ANI LoadAniIcon Stack Overflow Alexander Sotirov (Apr 02)
- Re: Windows .ANI LoadAniIcon Stack Overflow Thierry Zoller (Apr 02)
- Re: Windows .ANI LoadAniIcon Stack Overflow Larry Seltzer (Apr 02)
- Re: Windows .ANI LoadAniIcon Stack Overflow Jason Areff (Apr 02)
- Re: Windows .ANI LoadAniIcon Stack Overflow Larry Seltzer (Apr 02)
- Re: Windows .ANI LoadAniIcon Stack Overflow Jason Areff (Apr 02)
- Re: Windows .ANI LoadAniIcon Stack Overflow Larry Seltzer (Apr 02)
- Re: Windows .ANI LoadAniIcon Stack Overflow Larry Seltzer (Apr 01)
- Re: Windows .ANI LoadAniIcon Stack Overflow Morning Wood (Apr 02)
- Re: Windows .ANI LoadAniIcon Stack Overflow dev code (Apr 01)
- Re: Windows .ANI LoadAniIcon Stack Overflow Thierry Zoller (Apr 02)
- Re: Windows .ANI LoadAniIcon Stack Overflow Larry Seltzer (Apr 02)